CVE-2026-88805

HighCVSS 8.1/10Last modified Sep 29, 2026

Description

Incorrect credential cleaning on logout could be used by remote attackers to keep access credentials even after the account was logged out. Affected is SUSE Rancher 2.15 before 2.15.2.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-613

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Sep 28, 2026
Last modified: Sep 29, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-888067.5A malicious X server could exploit a buffer overflow in libX11 before 1.8.14 during handling of XkbGetMap overflowing the key_sym_map.CVE-2026-888078.9A heap overflow in libXrender before 0.9.13 in RenderQueryPictFormats could be used by malicious X servers to inject code into attached X cl CVE-2026-888088.8A vulnerability has been identified within Rancher Manager where the Fleet agent wrote resources to downstream clusters using its own cluste CVE-2026-88817.5Version 3.0.7 of the Securly Chrome Extension uses EVP_BytesToKey key derivation with MD5 and a single iteration for AES encryption. MD5 has CVE-2026-888156.2DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in sql_type_cast_svpv. When casting to SQL_NUMERIC, sql_type CVE-2026-888167.5DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in FetchHashKeyName. fetchrow_hashref uses the string pointe CVE-2026-888178.7An authenticated, non-guest user of Curiosity Workspace could enroll themselves as an administrator and member of an existing access group w CVE-2026-888196.3In Siglet current and past versions the refresh token handler do not enforce proof of possession of the issuer DID.CVE-2026-88826.4The WP ApplicantStack Jobs Display plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all version CVE-2026-888248.8The Master Blocks WordPress plugin before 1.5.0 does not have authorisation on one of its REST routes, allowing unauthenticated users to up CVE-2026-888258.8The iGMS Direct Booking WordPress plugin before 2.0 does not authorise or escape its widget appearance settings, allowing unauthenticated us CVE-2026-888268.8The SmugMug Embed WordPress plugin through 3.13 does not have authorisation or CSRF checks on an AJAX action that stores gallery data, and d