Incorrect authentication caching in the team member ship expansion of the Rancher Github authentication…

#!/usr/bin/env bash
# check_cve_2026_41053.sh — Detect CVE-2026-41053 (Rancher GitHub App auth team expansion)
# Usage: bash check_cve_2026_41053.sh <RANCHER_URL> <API_TOKEN>
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

set -euo pipefail

RANCHER_URL="${1:-}"
API_TOKEN="${2:-}"

if [[ -z "$RANCHER_URL" || -z "$API_TOKEN" ]]; then
  echo "Usage: $0 <RANCHER_URL> <API_TOKEN>"
  echo "  RANCHER_URL: e.g. https://rancher.example.com"
  echo "  API_TOKEN:   e.g. token-xxxxx:yyyyyyyy"
  exit 2
fi

# Strip trailing slash
RANCHER_URL="${RANCHER_URL%/}"

# Fetch Rancher server version
VERSION_JSON=$(curl -sk -H "Authorization: Bearer ${API_TOKEN}" "${RANCHER_URL}/v3/settings/server-version" 2>/dev/null || true)
if [[ -z "$VERSION_JSON" ]]; then
  echo "UNKNOWN — Could not connect to Rancher API at ${RANCHER_URL}"
  exit 2
fi

SERVER_VERSION=$(echo "$VERSION_JSON" | grep -oP '"value"\s*:\s*"\K[^"]+' || true)
if [[ -z "$SERVER_VERSION" ]]; then
  echo "UNKNOWN — Could not parse server version from API response"
  exit 2
fi

echo "Rancher version detected: ${SERVER_VERSION}"

# Check auth provider type
AUTH_JSON=$(curl -sk -H "Authorization: Bearer ${API_TOKEN}" "${RANCHER_URL}/v3/authConfigs" 2>/dev/null || true)
GITHUB_APP_ENABLED=$(echo "$AUTH_JSON" | grep -c '"githubapp"' || echo "0")

# Strip leading 'v' if present
VER="${SERVER_VERSION#v}"

# Parse major.minor.patch
IFS='.' read -r MAJOR MINOR PATCH <<< "$(echo "$VER" | grep -oP '^[0-9]+\.[0-9]+\.[0-9]+')"

if [[ -z "$MAJOR" || -z "$MINOR" || -z "$PATCH" ]]; then
  echo "UNKNOWN — Could not parse version components from '${SERVER_VERSION}'"
  exit 2
fi

# Determine vulnerability status
VULNERABLE=false

if [[ "$MAJOR" -eq 2 && "$MINOR" -eq 13 ]]; then
  if [[ "$PATCH" -lt 6 ]]; then
    VULNERABLE=true
  fi
elif [[ "$MAJOR" -eq 2 && "$MINOR" -eq 14 ]]; then
  if [[ "$PATCH" -lt 2 ]]; then
    VULNERABLE=true
  fi
fi

if [[ "$VULNERABLE" == "true" ]]; then
  if [[ "$GITHUB_APP_ENABLED" -gt 0 ]]; then
    echo "VULNERABLE — Rancher ${SERVER_VERSION} is in the affected range AND GitHub App auth provider appears enabled. CVE-2026-41053 is exploitable."
    exit 1
  else
    echo "VULNERABLE — Rancher ${SERVER_VERSION} is in the affected version range, but GitHub App auth provider does not appear active. The code bug exists but is not reachable without the provider enabled. Upgrade recommended."
    exit 1
  fi
else
  echo "PATCHED — Rancher ${SERVER_VERSION} is not in the affected range for CVE-2026-41053."
  exit 0
fi