Skip to content
CVE Tracker
Back

CVE-2026-88811

Rancher credentials disclosed to third-party hosts by the Rancher Manager meta proxy

Critical9.1
Published
Updated
Reserved
Assigned by
suse

Description

Missing filtering in the SUSE Rancher Manager meta proxy could cause passed in rancher credentials to be leaked to cloud providers. This affects SUSE Rancher 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, 2.13.0 up to 2.13.11,

Scores

CVSS scores of CVE-2026-88811, by who scored it
Scored byCVSSScoreVector
suseCNA (assigner)3.1Critical9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
NVDNVD · Awaiting Analysis3.1Critical9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS (exploitation in 30 days)
Not scored
CISA SSVC
Exploitation: none · Automatable: yes · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.1.

Weakness

Affected products

  • SUSE · Rancher

    • affected 2.15.0 – < 2.15.3
    • affected 2.14.0 – < 2.14.7
    • affected 2.13.0 – < 2.13.11
    • affected 2.12.0 – < 2.12.15
    • affected 2.11.0 – < 2.11.19

References (1)

Sources

The same CVE in the primary databases and aggregators, to check against.

Record last updated .