CVE-2026-88808: SUSE Rancher Fleet privilege escalation in resource deployment

CVE-2026-88808 · Severity: high · CVSS 8.8 · Published 2026-09-28

Rancher Fleet, a Kubernetes resource deployment management tool, contains a privilege escalation vulnerability where the Fleet agent wrote resources to shared downstream clusters using cluster-admin credentials instead of restricted service account permissions. In multi-tenant environments where teams share clusters, an attacker could write or overwrite secrets and configuration files in any namespace, potentially compromising workloads or redirecting container image pulls to malicious registries.

Technologies: Suse Rancher, Suse Rancher Fleet. Vendors: Suse.

Quick answers

Is CVE-2026-88808 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-88808 being exploited in the wild.
How severe is CVE-2026-88808?
High severity, with a CVSS score of 8.8, published 28 September 2026.
Which products and versions are affected?
Suse Rancher 2.15 before 2.15.2, 2.14 before 2.14.6, 2.13 before 2.13.10; Suse Rancher Fleet 0.16 before 0.16.2, 0.15 before 0.15.7, 0.14 before 0.14.11.
Is there a fix for CVE-2026-88808?
A patch was published on 2026-09-28: Patches released: Fleet v0.16.2, v0.15.7, v0.14.11; Rancher v2.15.2, v2.14.6, v2.13.10 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-88808 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-88808?
Check whether you run Suse Rancher or Suse Rancher Fleet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability stems from the Fleet agent copying Secrets and ConfigMaps from the management cluster to downstream clusters using its own cluster-admin credentials instead of impersonating the deployment's restricted ServiceAccount. An attacker with the ability to create Fleet resources (Bundle, GitRepo, or HelmOp) in a multi-tenant environment could write or overwrite any Secret or ConfigMap in any namespace of targeted downstream clusters, bypassing tenant RBAC controls. The fix ensures namespace creation and resource copying run with the deployment's pinned ServiceAccount identity, restricting writes to namespaces the tenant is entitled to access.

Affected products

  • SUSE Rancher Fleet 0.16 before 0.16.2, 0.15 before 0.15.7, 0.14 before 0.14.11
  • SUSE Rancher 2.15 before 2.15.2, 2.14 before 2.14.6, 2.13 before 2.13.10

Timeline

  • 2026-09-28: disclosed
  • 2026-09-28: patched: Patches released: Fleet v0.16.2, v0.15.7, v0.14.11; Rancher v2.15.2, v2.14.6, v2.13.10

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.