CVE-2026-88804

Unauthenticated update of public UI settings leading to stored cross-site scripting in Rancher

Critical9.6EPSS 1.0%

Published: 28 Sept 2026
Updated: 28 Sept 2026
Reserved: 10 Sept 2026
Assigned by: suse

Description

An unauthenticated update of public UI settings could be used by remote attackers to execute a stored cross-site scripting attack in the Rancher UI, in SUSE Rancher 2.15 before 2.15.2, 2.14 before 2.14.6, 2.13 before 2.13.10, 2.12 before 2.12.14 and 2.11 before 2.11.18.

Scores

CVSS scores of CVE-2026-88804, by who scored it
Scored by	CVSS	Score	Vector
suseCNA (assigner)	3.1	Critical9.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
NVDNVD · Awaiting Analysis	3.1	Critical9.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

EPSS (exploitation in 30 days): 1.0% · top 36% of all CVEs (6 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.6.

Weakness

CWE-79 Improper neutralization of input during web page generation ('cross-site scripting') (opens in a new tab)All about CWE-79 and its CVEs

Affected products

SUSE · Rancher
- affected 2.15.0 – < 2.15.2
- affected 2.14.0 – < 2.14.6
- affected 2.13.0 – < 2.13.10
- affected 2.12.0 – < 2.12.14
- affected 2.11.0se – < 2.11.18

References (1)

https://github.com/rancher/rancher/security/advisories/GHSA-992f-xh8r-jg2f (opens in a new tab)vendor-advisory

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2026-88804](https://trackcve.app/badge/CVE-2026-88804.svg)](https://trackcve.app/cve/CVE-2026-88804)

Record last updated 28 Sept 2026, 18:02 UTC.