CVE-2022-43760
HighCVSS 8.4Exploitation Probability (EPSS)
Elevated risk53th percentile - higher than 53% of all known CVEs
Summary
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SUSE Rancher allows users in some higher-privileged groups to inject code that is executed within another user's browser, enabling theft of sensitive information, content manipulation, or other malicious activities on behalf of victims. This could let a user with write access to affected areas act on behalf of an administrator once the administrator opens the affected web page. The issue affects Rancher from >= 2.6.0 before < 2.6.13 and from >= 2.7.0 before < 2.7.4.
Risk Assessment
A user with write access to affected areas could hijack an administrator's session and perform actions on their behalf, potentially leading to privilege escalation and data confidentiality breaches.
Recommendation
Update Rancher to version 2.6.13 or 2.7.4 (or later) to remediate the XSS vulnerability.
Other vulnerabilities in SUSE Rancher
See all- CVE-2026-88804Critical
In SUSE Rancher (versions 2.15 before 2.15.2, 2.14 before 2.14.6, 2.13 before 2.13.10, 2.12 before 2.12.14, and 2.11 before 2.11.18), an unauthenticated update of public UI settings could be used by remote attackers to execute a stored cross-site scripting (XSS) attack in the Rancher UI.
- CVE-2023-22647Critical
An Improper Privilege Management vulnerability in SUSE Rancher allowed standard users to leverage existing permissions to manipulate Kubernetes secrets in the local cluster, resulting in the secret being deleted while read-level permissions were preserved. Followed by specially crafted commands, this could let a user gain access to tokens belonging to service accounts in the local cluster. Affects Rancher >= 2.6.0 < 2.6.13 and >= 2.7.0 < 2.7.4.
- CVE-2026-88805High
In SUSE Rancher 2.15 before 2.15.2, incorrect credential cleaning on logout could be used by remote attackers to keep access credentials even after the account was logged out, potentially leading to unauthorized access.
Original NVD description (English source)
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SUSE Rancher allows users in some higher-privileged groups to to inject code that is executed within another user's browser, allowing the attacker to steal sensitive information, manipulate web content, or perform other malicious activities on behalf of the victims. This could result in a user with write access to the affected areas being able to act on behalf of an administrator, once an administrator opens the affected web page. This issue affects Rancher: from >= 2.6.0 before < 2.6.13, from >= 2.7.0 before < 2.7.4.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS