CVE-2026-88808 – SUSE Rancher
“One unauthenticated settings change can turn the Rancher console into an attack platform against every cluster it manages.”
SUSE has released fixes for four vulnerabilities in Rancher and Rancher Fleet that put cluster management and tenant isolation at risk. CVE-2026-88804 has a CVSS score of 9.6, Critical severity. It lets unauthenticated remote attackers change public UI settings and plant stored cross-site scripting in the Rancher UI. It affects Rancher 2.15 before 2.15.2, 2.14 before 2.14.6, 2.13 before 2.13.10, 2.12 before 2.12.14, and 2.11 before 2.11.18. CVE-2026-88805 has a CVSS score of 8.1, High severity. Rancher 2.15 before 2.15.2 does not clear credentials correctly on logout, so attackers can keep access after a user signs out.
Two Fleet flaws break multi-tenant boundaries. CVE-2026-88808 has a CVSS score of 8.8, High severity. The Fleet agent writes to downstream clusters with its own cluster-admin credentials instead of the deployment's pinned ServiceAccount, which lets tenants overwrite configuration they should not touch. It is fixed in Fleet 0.16.2, 0.15.7, and 0.14.11. CVE-2026-93538 has a CVSS score of 7.1, High severity. A cluster registered by an agent can carry reserved labels that match targeting rules meant for another tenant's cluster, which sends that tenant's deployments to the wrong place. It is fixed in Fleet 0.16.1, 0.15.6, 0.14.10, 0.13.15, and 0.12.19. Three of the four flaws allow privilege escalation, and every Rancher deployment should move to the fixed release for its branch.
Key Details
- Affected Product
- Suse Rancher Fleet
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- Low
- User Interaction
- None
- CWE Classification
- CWE-250