CVE-2026-88809
HighCVSS 7.6Summary
In the SUSE Rancher Manager meta proxy endpoint (/meta/proxy), the allowlist decision was evaluated where it could not stop a request from being forwarded. A rejected destination was logged but the request was still handed to the proxy's transport.
Risk Assessment
An attacker can bypass the allowlist and forward requests to unauthorized destinations, potentially leading to unauthorized access or data leakage.
Recommendation
Update SUSE Rancher to a version containing the fix; affects versions 2.15.0-2.15.3, 2.14.0-2.14.7, 2.13.0-2.13.11, 2.12.0-2.12.15, 2.11.0-2.11.19 and older.
Other vulnerabilities in SUSE Rancher Manager
See all- CVE-2026-88810High
A privilege escalation issue was discovered in Rancher Manager's role-based access control. The inheritedNamespacedRules field of a GlobalRole propagated permissions into namespaces of downstream clusters without privilege-escalation validation, potentially allowing a non-administrative user to gain excessive permissions.
- CVE-2026-88811Critical
Missing filtering in the SUSE Rancher Manager meta proxy could cause passed-in Rancher credentials to be leaked to cloud providers. This affects SUSE Rancher 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, and 2.13.0 up to 2.13.11.
- CVE-2026-104623Medium
A security vulnerability exists in the authorization handling for the local (management) cluster shell feature of SUSE Rancher Manager 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, 2.13.0 up to 2.13.11, 2.12.0 up to 2.12.15, 2.11.0 up to 2.11.19 and possibly older versions. The authorization check introduced to protect this feature was not applied to every API route that can reach it, so an alternative request form reached the shell handler without the access check being evaluated. This could allow any authenticated user to run a pod on the management cluster.
Original NVD description (English source)
A security vulnerability exists in the SUSE Rancher Manager meta proxy endpoint (/meta/proxy). This endpoint is intended to forward requests only to destinations that appear on a configured allowlist. The allowlist decision was evaluated in a place where it could not stop a request from being forwarded, so a rejected destination was logged but the request was still handed to the proxy's transport. This affects SUSE Rancher 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, 2.13.0 up to 2.13.11, 2.12.0 up to 2.12.15, 2.11.0 up to 2.11.19 and potentially older EOL versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS