All vulnerabilities
CVE-2026-88804GHSA-992f-xh8r-jg2f

Unauthenticated update of public UI settings leading to stored cross-site scripting in Rancher

SUSE RancherApplications & CMS
Open in ThreatlineRecord JSON
CVSS
9.6Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.60%Chance of exploitation activity in the next 30 days, higher than 48% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2.15.2Also 2.14.6, 2.13.10 and 2 moreCVE List
Published28 Sep 2026Updated 2 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

An unauthenticated update of public UI settings could be used by remote attackers to execute a stored cross-site scripting attack in the Rancher UI, in SUSE Rancher 2.15 before 2.15.2, 2.14 before 2.14.6, 2.13 before 2.13.10, 2.12 before 2.12.14 and 2.11 before 2.11.18.

Text from CVE List

Affected versions 10

  • Rancheraffected: 2.15.0 before 2.15.2CVE List
  • Rancheraffected: 2.14.0 before 2.14.6CVE List
  • Rancheraffected: 2.13.0 before 2.13.10CVE List
  • Rancheraffected: 2.12.0 before 2.12.14CVE List
  • Rancheraffected: 2.11.0se before 2.11.18CVE List
  • github.com/rancher/rancher, go>=v2.15.0, <v2.15.2GitHub
  • github.com/rancher/rancher, go>=v2.14.0, <v2.14.6GitHub
  • github.com/rancher/rancher, go>=v2.13.0, <v2.13.10GitHub
  • github.com/rancher/rancher, go>=v2.12.0, <v2.12.14GitHub
  • github.com/rancher/rancher, go>=v2.11.0, <v2.11.18GitHub

References 1