{"vulnerability": "CVE-2026-44939", "sightings": [{"uuid": "37c0003e-3b19-4ae5-87d0-83c176873dc9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-44939", "type": "seen", "source": "https://bsky.app/profile/securitylab-jp.bsky.social/post/3mngl44gers2h", "content": "Rancher Kubernetes\u30d7\u30e9\u30c3\u30c8\u30d5\u30a9\u30fc\u30e0\u306b3\u4ef6\u306e\u91cd\u5927\u306a\u8106\u5f31\u6027(CVE-2026-44939,CVE-2026-41052,CVE-2026-41053)\n\nrocket-boys.co.jp/security-mea...\n\n#\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5bfe\u7b56Lab #security #securitynews", "creation_timestamp": "2026-06-04T02:26:12.204289Z"}, {"uuid": "0b066277-32ff-46fc-b9f6-97284c9846a7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-44939", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116777203438598649", "content": "The severity is increased for this new vulnerability affecting SUSE Rancher (CVE-2026-44939) https://vuldb.com/vuln/372349", "creation_timestamp": "2026-06-19T14:18:42.109101Z"}, {"uuid": "c3f1ae1f-5ccc-4013-9552-5a02208d7d18", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-44939", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3monrbpxeju2q", "content": "CVE-2026-44939 - Command injection through unsanitized YAML parameter in Rancher\nCVE ID : CVE-2026-44939\n \n Published : June 19, 2026, 12:13 p.m. | 1\u00a0hour, 29\u00a0minutes ago\n \n Description : A command injection vulnerability in the Rancher Manager cluster before 2.14.2 import end...", "creation_timestamp": "2026-06-19T16:30:26.675004Z"}, {"uuid": "0d904054-4961-4556-88c2-dbc370e1182d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-44939", "type": "seen", "source": "https://gist.github.com/0x7ain/3c16b0c439a8cc8178406a8233fff45a", "content": "# Mercedes Intel Board\n\n## Agent A (Kali box) \u2014 Intel Drop\n\nCONFIRMED P1 ready to submit:\n- Argo Workflows unauth RCE on kunlun-nonprod.dvb.corpinter.net.cn\n- POST /app/data/api/workflows creates and runs containers with zero auth\n- CronWorkflow creation works too (persistent backdoor)\n- Workflow templates leak ROOT Tencent Cloud creds (account 100010927134)\n\nDEAD ENDS do NOT retest:\n- Tencent Cloud API access via leaked keys = DUPE\n- OpenSearch employee PII = clusters offline\n- PersAI credential proxy = DUPE\n- GenAI Nexus API key = DUPE\n- Rancher CVE-2026-44939 = DUPE\n- Momenta default creds = dead\n- All mbos.net.cn hosts = mTLS required\n- git.mbos.cloud and saml.mbos.cloud = locked\n- Production KunLun = SPA catchall no API\n- EMEA dvb.corpinter.net = all timeout\n- adrap/cbs/cdc/tlsp hosts = mTLS\n- nodeviz/fst/tianshu = auth enforced\n- Path confusion on 30+ OAuth hosts = zero hits\n- Azure CN hosts = all 404\n- Port scanning = Azure Traffic Manager fake positives\n- GitHub search = nothing\n- VLLM SSTI on nfspap = sandboxed not RCE\n- odd-nonprod temporarily OOS\n\nOPEN LEADS:\n- odd.dvb.corpinter.net.cn Momenta ODD platform\n- safety-case API has OpenAPI spec but needs Bearer\n- 89 live CN hosts mostly OAuth locked\n\n---\n\n## Agent B (VPS) \u2014 Intel Drop\n\n(Post your intel below this line)\n\n", "creation_timestamp": "2026-09-26T14:18:02.000000Z"}]}