Is CVE-2026-88804 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-88804 being exploited in the wild.

How severe is CVE-2026-88804?

Critical severity, with a CVSS score of 9.6, published 28 September 2026.

Which products and versions are affected?

Suse Rancher 2.15.0 to before 2.15.2, 2.14.0 to before 2.14.6, 2.13.0 to before 2.13.10, 2.12.0 to before 2.12.14, 2.11.0 to before 2.11.18.

Is there a fix for CVE-2026-88804?

A patch was published on 2026-09-23: Rancher versions 2.15.2, 2.14.6, 2.13.10, 2.12.14, and 2.11.18 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-88804 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-88804?

Check whether you run Suse Rancher at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-88804: SUSE Rancher stored cross-site scripting in public UI settings

CVE-2026-88804 · Severity: critical · CVSS 9.6 · Published 2026-09-28

SUSE Rancher is a container and Kubernetes management platform. A critical flaw allows unauthenticated remote attackers to inject malicious code into login page settings, which is then executed in the browsers of administrators and users who access the login screen. This can lead to theft of administrator credentials, session hijacking, and complete compromise of Rancher and all downstream Kubernetes clusters it manages.

Technologies: Suse Rancher. Vendors: Suse.

Quick answers

Is CVE-2026-88804 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-88804 being exploited in the wild.
How severe is CVE-2026-88804?: Critical severity, with a CVSS score of 9.6, published 28 September 2026.
Which products and versions are affected?: Suse Rancher 2.15.0 to before 2.15.2, 2.14.0 to before 2.14.6, 2.13.0 to before 2.13.10, 2.12.0 to before 2.12.14, 2.11.0 to before 2.11.18.
Is there a fix for CVE-2026-88804?: A patch was published on 2026-09-23: Rancher versions 2.15.2, 2.14.6, 2.13.10, 2.12.14, and 2.11.18 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-88804 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-88804?: Check whether you run Suse Rancher at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An unauthenticated API endpoint for reading public UI settings is vulnerable to parameter injection attacks that bypass its read-only design, allowing modifications to stored settings. One of these settings (ui-pl, first-login, ui-banners, ui-brand, ui-issues, or ui-default-landing) is rendered as raw HTML on the Rancher login page, enabling stored XSS execution. The attack requires only network access and no credentials; the malicious payload persists until the settings are manually corrected or the system is patched.

Affected products

SUSE Rancher 2.15.0 to before 2.15.2, 2.14.0 to before 2.14.6, 2.13.0 to before 2.13.10, 2.12.0 to before 2.12.14, 2.11.0 to before 2.11.18

Timeline

2026-09-23: disclosed
2026-09-23: patched: Rancher versions 2.15.2, 2.14.6, 2.13.10, 2.12.14, and 2.11.18 released

References

https://github.com/rancher/rancher/security/advisories/GHSA-992f-xh8r-jg2f

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.