# Rancher Release v2.14.2 **URL:** \ **Category:** Announcements\ **Created:** [May 28, 2026, 4:21pm UTC](https://forums.suse.com/t/rancher-release-v2-14-2/46337 "2026-05-28T16:21:32Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![Jono-SUSE-Rancher](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/jono-suse-rancher/32/7319_2.png) [@Jono-SUSE-Rancher](https://forums.suse.com/u/Jono-SUSE-Rancher)\ **Post date:** [May 28, 2026, 4:21pm UTC](https://forums.suse.com/t/rancher-release-v2-14-2/46337/1 "2026-05-28T16:21:33Z")
# Release v2.14.2 Rancher v2.14.2 is the latest patch release of Rancher. This is a Community version release that introduces maintenance updates and bug fixes. For more information on new features in the general minor release, see the [v2.14.0 release notes](https://github.com/rancher/rancher/releases/tag/v2.14.0). ## Security Fixes for Vulnerabilities This release addresses the following security issues: ### Rancher - Fixed a security vulnerability in the GitHub App authentication provider where users incorrectly inherited permissions from all teams within their GitHub organization, rather than only the specific teams to which they belonged. Upon upgrading, Rancher automatically triggers a mandatory refresh of all affected user `principals` to remove these incorrectly assigned team memberships and restore proper access. For more information, refer to [CVE-2026-41053](https://github.com/rancher/rancher/security/advisories/GHSA-4j6x-2764-m8gh). - Updated the permissions of the built-in `project-owner` role to no longer include the `updatepsa` verb. This prevents users with this role from bypassing restricted PSA policies or deploying privileged workloads within their projects. If your organization requires users to retain this capability, administrators must create a custom project role that explicitly grants the `updatepsa` verb for the project resource. For more information, refer to [CVE-2026-41052](https://github.com/rancher/rancher/security/advisories/GHSA-vx8h-4prv-g744). - Rancher now validates the `authImage` parameter in cluster import manifests to prevent YAML injection attacks. For more information, refer to [CVE-2026-44939](https://github.com/rancher/rancher/security/advisories/GHSA-mhc6-2gfq-xx62). ### Fleet - Resolved a conceptual security issue for multi-tenant and multi-user single-cluster environments by introducing a `Policy` resource. If you have been using `GitRepoRestriction`, please migrate to `Policy`. For more information, refer to [CVE-2026-44935](https://github.com/rancher/rancher/fleet/security/advisories/GHSA-xr65-5cpm-g36x). - Fleet now mandates that `helmRepoURLRegex` be set on the `GitRepo` resource before Helm repository credentials are forwarded to chart repository URLs specified in `fleet.yaml`. Existing `GitRepo` resources that have a Helm secret configured are automatically migrated upon upgrade to preserve their previous behavior. For more information, refer to [CVE-2026-44936](https://github.com/rancher/rancher/fleet/security/advisories/GHSA-hx4v-cxpf-vh8m). - Fixed a security vulnerability in the webhook component that enabled attackers to forge webhooks, which Fleet would then process if webhook shared secrets were not configured. For more information, refer to [CVE-2026-44937](https://github.com/rancher/rancher/fleet/security/advisories/GHSA-jmf4-m7j9-g72r). - Fleet now prevents `namespaceLabels` in `fleet.yaml` from overwriting Pod Security Standards enforcement labels on existing namespaces. For more information, refer to [CVE-2026-44938](https://github.com/rancher/rancher/fleet/security/advisories/GHSA-864g-863m-vcvq). ### SUSE Observability - Fixed a security vulnerability that exposed service tokens by migrating the token to a secure Kubernetes Secret that is automatically deleted when the extension is uninstalled. For more information refer to [CVE-2026-44940](https://github.com/StackVista/rancher-extension-stackstate/security/advisories/GHSA-7c27-jc6w-pw95). ### SUSE Rancher AI Assistant - Fixed an information disclosure vulnerability where sensitive configuration secrets and MCP responses were exposed when the logging level was set to `DEBUG`. For more information, refer to [CVE-2026-44934](https://github.com/rancher/rancher-ai-agent/security/advisories/GHSA-5r2r-h824-fr5v). For additional details, see the Security Advisories and CVEs page in Rancher’s [documentation](https://ranchermanager.docs.rancher.com/v2.14/reference-guides/rancher-security/security-advisories-and-cves) or in Rancher’s GitHub [repository](https://github.com/rancher/rancher/security/advisories). ## Rancher General ### Known Issues - A known issue can cause Rancher Logging DaemonSets (`rancher-logging-rke2-journald-aggregator` and `rancher-logging-root-fluentbit`) to enter `CrashLoopBackOff` or remain unstable when host `inotify` limits are too low. As a workaround, increase `fs.inotify.max_user_watches` and `fs.inotify.max_user_instances` on affected nodes. See [#54216](https://github.com/rancher/rancher/issues/54216). ## Rancher App (Global UI) ### Major Bug Fixes - It is now possible to install the same chart multiple times in the same cluster from **Apps** \> **Charts** by using **Install as a new instance**. See [#16927](https://github.com/rancher/dashboard/issues/16927) and [#16907](https://github.com/rancher/dashboard/issues/16907). - Fixed an issue where add-on chart values could be lost when viewing or editing cluster configuration in the Rancher UI. See [#17527](https://github.com/rancher/dashboard/issues/17527) and [#17498](https://github.com/rancher/dashboard/issues/17498). ## Changes Since v2.14.1 See the full list of [changes](https://github.com/rancher/rancher/compare/v2.14.1%E2%80%A6v2.14.2). ## Install/Upgrade Notes If you’re installing Rancher for the first time, your environment must fulfill the [installation requirements](https://ranchermanager.docs.rancher.com/v2.14/getting-started/installation-and-upgrade/installation-requirements). > [!IMPORTANT] > > - Rancher now requires the cluster it runs on to have the [Kubernetes API Aggregation Layer](https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/apiserver-aggregation/) enabled. This is because Rancher extends Kubernetes with additional APIs by registering its own extension API server. Please note that all versions of Kubernetes supported in this Rancher versions K8s distributions (RKE2/K3s) will have the aggregation layer configured and enabled by default. > > - Rancher Kubernetes Engine (RKE/RKE1) has reached end of life as of **July 31, 2025**. Rancher versions 2.12.0 and later no longer support provisioning or managing downstream RKE1 clusters. We recommend replatforming RKE1 clusters to RKE2 to ensure continued support and security updates. Learn more about the transition [here](https://www.suse.com/support/kb/doc/?id=000021518). > > - It is crucial that you review the available disk space on your nodes and plan accordingly before upgrading to Rancher v2.12.0 and later to avoid potential disk pressure and pod eviction issues. > > - Rancher now has an enablement option called [`AUDIT_LOG_ENABLED`](https://ranchermanager.docs.rancher.com/v2.14/how-to-guides/advanced-user-guides/enable-api-audit-log#viewing-api-audit-logs:~:text=Description-,AUDIT_LOG_ENABLED,-false%20%2D%20Disables%20the) for API Audit Logs for a Rancher installation. ## Changes in Image Artifacts Image artifact digests are renamed in Rancher v2.12.0, v2.11.4 and v2.10.8. Up until this change, separate image digests files for each operating system and architecture have been maintained for compatibility reasons. With this change, only one file for each operating system is to be provided: - The `rancher-images-digests-linux-amd64.txt` and `rancher-images-digests-linux-arm64.txt` files are to be renamed to `rancher-images-digests-linux.txt`. - The `rancher-images-digests-windows-ltsc2019.txt` and `rancher-images-digests-windows-ltsc2022.txt` files are to be renamed to `rancher-images-digests-windows.txt`. ## Upgrade Requirements - **Creating backups:** [Create a backup](https://ranchermanager.docs.rancher.com/v2.14/how-to-guides/new-user-guides/backup-restore-and-disaster-recovery/back-up-rancher) before you upgrade Rancher. To roll back Rancher after an upgrade, you must first back up and restore Rancher to the previous Rancher version. Because Rancher will be restored to the same state as when the backup was created, any changes post-upgrade will not be included after the restore. - **Helm version requirements:** - **CNI requirements:** - **Requirements for air-gapped environments:** ## Versions ### Images - rancher/rancher:v2.14.2 ### Tools - CLI - [v2.14.2](https://github.com/rancher/cli/releases/tag/v2.14.2) ### Kubernetes Versions for RKE2/K3s - v1.35.4 (Default) - v1.34.7 - v1.33.11 ### Rancher Helm Chart Versions In Rancher v2.6.0 and later, in the **Apps & Marketplace** UI, many Rancher Helm charts are named with a major version that starts with _100_. This avoids simultaneous upstream changes and Rancher changes from causing conflicting version increments. This also complies with semantic versioning (SemVer), which is a requirement for Helm. You can see the upstream version number of a chart in the build metadata, for example: `100.0.0+up2.1.0`. See [#32294](https://github.com/rancher/rancher/issues/32294). ## Previous Rancher Behavior Changes ### Previous Rancher Behavior Changes - Rancher General - **Rancher v2.14.0:** - **Rancher v2.13.0:** ### Previous Rancher Behavior Changes - Authentication - **Rancher v2.14.0:** ### Previous Rancher Behavior Changes - Backup/Restore - **Rancher v2.14.0:** ### Previous Rancher Behavior Changes - Cluster Provisioning - **Rancher v2.14.1:** - **Rancher v2.14.0:** ### Previous Rancher Behavior Changes - Continuous Delivery (Fleet) - **Rancher v2.14.0:** ### Previous Rancher Behavior Changes - RKE2 Provisioning - **Rancher v2.14.0:** ### Previous Rancher Behavior Changes - Rancher CLI - **Rancher v2.14.0:** ### Previous Rancher Behavior Changes - Rancher App (Global UI) - **Rancher v2.13.0:** ## Future Rancher Behavior Changes ### Retention Policy for Rancher App Charts To improve repository performance, Rancher is introducing a lifecycle management policy for charts available in the Apps feature of Rancher, specifically in the “Rancher” repository. - **The Policy:** Rancher will transition from a cumulative model (retaining all historical versions forever) to a retention model that preserves chart versions for the **seven (7) most recent Rancher minor releases** (approximately a 2.5-year window). - **Timeline - Rancher v2.13 & v2.14:** Legacy chart versions (older than the 7-version window) remain available. - **Rancher v2.15:** This will be the first version to enforce the policy. Versions falling outside the 7-version window and older than two years will no longer be available. **Impact:** This change is non-destructive for existing Rancher installations. Historical versions will remain accessible but will not be available in newer release branches once they age out of the 7-version window. You are advised to upgrade your applications before upgrading to Rancher v2.15. Uninstallation after v2.15, and replacement with an updated version, will still be possible. ## Long-standing Known Issues ### Long-standing Known Issues - Cluster Provisioning - Not all cluster tools can be installed on a hardened cluster. - **Rancher v2.8.1:** ### Long-standing Known Issues - RKE2 Provisioning - **Rancher v2.7.7:** - **Rancher v2.7.6:** ### Long-standing Known Issues - K3s Provisioning - **Rancher v2.7.6:** - **Rancher v2.7.2:** ### Long-standing Known Issues - Rancher App (Global UI) - **Rancher v2.10.0:** - **Rancher v2.9.2:** - **Rancher v2.7.7:** ### Long-standing Known Issues - EKS - **Rancher v2.7.0:** ### Long-standing Known Issues - Authentication - **Rancher v2.9.0:** ### Long-standing Known Issues - Rancher Webhook - **Rancher v2.7.2:** ### Long-standing Known Issues - Virtualization Management (Harvester) - **Rancher v2.14.1:** - **Rancher v2.13.1:** - **Rancher v2.7.2:** ### Long-standing Known Issues - Backup/Restore - When migrating to a cluster with the Rancher Backup feature, the server-url cannot be changed to a different location. It must continue to use the same URL. - **Rancher v2.13.0:** - **Rancher v2.7.7:** ---
**Author:** ![Jono-SUSE-Rancher](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/jono-suse-rancher/32/7319_2.png) [@Jono-SUSE-Rancher](https://forums.suse.com/u/Jono-SUSE-Rancher)\ **Post date:** [May 28, 2026, 4:21pm UTC](https://forums.suse.com/t/rancher-release-v2-14-2/46337/2 "2026-05-28T16:21:36Z")