CVE-2026-88804

CriticalCVSS 9.6

Published: 28/09/2026(UTC)Translated: 28/09/2026(UTC)NVD NIST

Summary

In SUSE Rancher (versions 2.15 before 2.15.2, 2.14 before 2.14.6, 2.13 before 2.13.10, 2.12 before 2.12.14, and 2.11 before 2.11.18), an unauthenticated update of public UI settings could be used by remote attackers to execute a stored cross-site scripting (XSS) attack in the Rancher UI.

Risk Assessment

An XSS attack could allow execution of malicious scripts in the administrator's browser, potentially leading to session theft, account takeover, or unauthorized actions in the managed cluster.

Recommendation

Update Rancher to one of the patched versions (2.15.2, 2.14.6, 2.13.10, 2.12.14, 2.11.18 or later). Restrict access to public UI settings and implement XSS protections.

Other vulnerabilities in SUSE Rancher

CVE-2026-88805High
In SUSE Rancher 2.15 before 2.15.2, incorrect credential cleaning on logout could be used by remote attackers to keep access credentials even after the account was logged out, potentially leading to unauthorized access.

Original NVD description (English source)

An unauthenticated update of public UI settings could be used by remote attackers to execute a stored cross-site scripting attack in the Rancher UI, in SUSE Rancher 2.15 before 2.15.2, 2.14 before 2.14.6, 2.13 before 2.13.10, 2.12 before 2.12.14 and 2.11 before 2.11.18.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS