Package
harvester-webhook
Component
github.com/rancher/rancher
Latest update
Fixed version
1.8.1-r32
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Fixed version
1.8.1-r32Status
Impact
This CVE is carried by the bundled github.com/rancher/rancher dependency and cannot be remediated as a package-level bump against harvester v1.8.1, which hard-pins its Kubernetes stack via go.mod replace directives (k8s.io/* => v0.33.7, cluster-api v1.9.5, controller-runtime v0.21.0). The earliest rancher revision containing the fix (2aa77eb283e7) is built against Kubernetes 0.36.2 / cluster-api v1.13.2 — three minors ahead — and cluster-api ≥v1.12 removed the api/v1beta1 package harvester own code imports; bumping rancher therefore fails to compile. Same blocker as CVE-2026-41052 and CVE-2025-67601, but furthest ahead of harvester pinned stack. Pending upstream: resolves when harvester migrates off api/v1beta1 onto the Kubernetes 0.36+/cluster-api ≥v1.12 stack (a release beyond v1.8.1).
Status