Rancher meta proxy allowlist bypass leading to server-side request forgery

Description

A security vulnerability exists in the SUSE Rancher Manager meta proxy endpoint (/meta/proxy). This endpoint is intended to forward requests only to  destinations that appear on a configured allowlist. The allowlist decision was evaluated in a  place where it could not stop a request from being forwarded, so a rejected destination was logged but the request was still handed to the proxy's transport. This affects SUSE Rancher 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, 2.13.0 up to 2.13.11, 2.12.0 up to 2.12.15, 2.11.0 up to 2.11.19 and potentially older EOL versions.

Scores

EPSS (exploitation in 30 days)

0.32% · top 75% of all CVEs (7 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.6.

Weakness

• CWE-918 Server-Side request forgery (SSRF) (opens in a new tab)All about CWE-918 and its CVEs

Affected products

• SUSE · Rancher

  • affected 2.15.0 – < 2.15.3
  • affected 2.14.0 – < 2.14.7
  • affected 2.13.0 – < 2.13.11
  • affected 2.12.0 – < 2.12.15
  • affected 2.11.0 – < 2.11.19

References (1)

• https://github.com/rancher/rancher/security/advisories/GHSA-f9gf-wh3x-jx3v (opens in a new tab)vendor-advisory

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-88809](https://trackcve.app/badge/CVE-2026-88809.svg)](https://trackcve.app/cve/CVE-2026-88809)

Record last updated 2 Nov 2026, 18:55 UTC.