CVE-2026-88810: SUSE Rancher privilege escalation in GlobalRole RBAC

CVE-2026-88810 · Severity: high · CVSS 7.2 · Published 2026-11-02

SUSE Rancher Manager is a platform for managing Kubernetes clusters across an organization. A flaw in role-based access control allows authenticated users who have been granted permission to create or modify global roles to escalate their own permissions beyond what they were originally granted, potentially affecting all downstream clusters managed by the Rancher instance. This could allow unauthorized access, modification, or disruption of resources across multiple clusters.

Technologies: Suse Rancher. Vendors: Suse.

Quick answers

Is CVE-2026-88810 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-88810 being exploited in the wild.
How severe is CVE-2026-88810?
High severity, with a CVSS score of 7.2, published 2 November 2026.
Which products and versions are affected?
Suse Rancher 2.15.2; Suse Rancher Webhook 0.11.0 to 0.11.4, 0.12.0 to 0.12.1.
Is there a fix for CVE-2026-88810?
Yes: fixed in Rancher 2.15.3, Rancher Webhook 0.11.4, 0.12.1. Until then: Review and restrict custom global roles that delegate create or update permissions on GlobalRoles and creation of GlobalRoleBindings to trusted administrators only. Audit existing GlobalRole objects for unexpected inheritedNamespacedRules entries and remove any that were not intentionally configured. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-88810 attacked?
It is attacked over the network.
Am I affected by CVE-2026-88810?
Check whether you run Suse Rancher or Suse Rancher Webhook at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: Rancher 2.15.3, Rancher Webhook 0.11.4, 0.12.1

Review and restrict custom global roles that delegate create or update permissions on GlobalRoles and creation of GlobalRoleBindings to trusted administrators only. Audit existing GlobalRole objects for unexpected inheritedNamespacedRules entries and remove any that were not intentionally configured.

Technical details

A privilege escalation vulnerability exists in the GlobalRole RBAC implementation where the inheritedNamespacedRules field bypasses privilege-escalation validation that is applied to other permission-carrying fields. An authenticated user with delegated permissions to create/update GlobalRoles can craft a global role binding that grants themselves permissions in downstream cluster namespaces that exceed their current permissions. The fix requires upgrading Rancher to version 2.15.3 or webhook to 0.11.4 / 0.12.1 to add proper validation of inheritedNamespacedRules against the requesting user's permissions.

Affected products

  • SUSE Rancher 2.15.2
  • SUSE Rancher Webhook 0.11.0 to 0.11.4, 0.12.0 to 0.12.1

Timeline

  • 2026-10-29: disclosed
  • 2026-11-02: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.