CVE-2026-88811: SUSE Rancher Manager credential leak in meta proxy

CVE-2026-88811 · Severity: critical · CVSS 9.1 · Published 2026-11-02

SUSE Rancher Manager is a container orchestration platform used to manage Kubernetes clusters across hybrid cloud environments. The meta proxy component, which forwards requests to cloud provider APIs on behalf of users, failed to filter out Rancher user credentials from outgoing requests. An attacker or cloud provider receiving these requests could obtain live Rancher credentials with potentially administrative privileges over the Rancher control plane and managed clusters.

Technologies: Suse Rancher Manager. Vendors: Suse.

Quick answers

Is CVE-2026-88811 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-88811 being exploited in the wild.
How severe is CVE-2026-88811?
Critical severity, with a CVSS score of 9.1, published 2 November 2026.
Which products and versions are affected?
Suse Rancher Manager 2.15.0-2.15.2, 2.14.0-2.14.6, 2.13.0-2.13.10, 2.12.0-2.12.14, 2.11.0-2.11.18.
Is there a fix for CVE-2026-88811?
Yes: fixed in 2.15.3, 2.14.7, 2.13.11, 2.12.15, 2.11.19. Until then: Review and restrict the hosts the meta proxy is allowed to contact by removing unnecessary entries from the whitelist-domain setting and custom cluster and node driver allowlists. Remove custom ProxyEndpoint resources that are not strictly required. Administrators should rotate or delete long-lived API tokens and invalidate user sessions after upgrading to a patched version, as credentials may have been exposed during normal operation. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-88811 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-88811?
Check whether you run Suse Rancher Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: 2.15.3, 2.14.7, 2.13.11, 2.12.15, 2.11.19

Review and restrict the hosts the meta proxy is allowed to contact by removing unnecessary entries from the whitelist-domain setting and custom cluster and node driver allowlists. Remove custom ProxyEndpoint resources that are not strictly required. Administrators should rotate or delete long-lived API tokens and invalidate user sessions after upgrading to a patched version, as credentials may have been exposed during normal operation.

Technical details

The meta proxy in affected versions did not strip Authorization and Cookie headers containing Rancher session credentials when forwarding requests to third-party cloud provider hosts. This allowed browser session cookies and API tokens to be transmitted to any host on the configured allowlist, exposing valid credentials with the caller's privileges. The fix removes credential headers from all outgoing requests and requires clients to explicitly set authentication headers when needed via dedicated proxy headers.

Affected products

  • SUSE Rancher Manager 2.15.0-2.15.2, 2.14.0-2.14.6, 2.13.0-2.13.10, 2.12.0-2.12.14, 2.11.0-2.11.18

Timeline

  • 2026-10-29: disclosed
  • 2026-11-02: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.