CVE-2026-88811

CriticalCVSS 9.1/10Last modified Nov 3, 2026

Description

Missing filtering in the SUSE Rancher Manager meta proxy could cause passed in rancher credentials to be leaked to cloud providers. This affects SUSE Rancher 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, 2.13.0 up to 2.13.11,

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-201

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
SUSE	Rancher	>= 2.15.0, < 2.15.3; >= 2.14.0, < 2.14.7; >= 2.13.0, < 2.13.11; >= 2.12.0, < 2.12.15; >= 2.11.0, < 2.11.19

References

https://github.com/rancher/rancher/security/advisories/GHSA-x82x-2qj6-5rm2

Timeline

Published: Nov 2, 2026
Last modified: Nov 3, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-888127.8A double free in XKB SetGeometryin X.Org X Server before 21.1.25 and X Wayland before 24.1.14 could be used by attached clients to cause a c CVE-2026-888135.3The YITH WooCommerce Gift Cards WordPress plugin through 4.39.0 does not reconcile the value of a gift card it issues against the amount act CVE-2026-888143.7The YITH WooCommerce Gift Cards WordPress plugin before 4.38.1 does not lock or atomically update a gift card's balance when it is redeemed CVE-2026-888156.2DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in sql_type_cast_svpv. When casting to SQL_NUMERIC, sql_type CVE-2026-888167.5DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in FetchHashKeyName. fetchrow_hashref uses the string pointe CVE-2026-888178.7An authenticated, non-guest user of Curiosity Workspace could enroll themselves as an administrator and member of an existing access group w CVE-2026-888196.3In Siglet current and past versions the refresh token handler do not enforce proof of possession of the issuer DID.CVE-2026-88826.4The WP ApplicantStack Jobs Display plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all version CVE-2026-88822Issue summary: QUIC, when performing automated peer detection, may allow uninitialized stack data to leak into the received address which is CVE-2026-88823Issue summary: The AES-GCM-SIV implementation treats a zero-length Additional Authenticated Data (AAD) update as a reset of all the AAD supp CVE-2026-888248.8The Master Blocks WordPress plugin before 1.5.0 does not have authorisation on one of its REST routes, allowing unauthenticated users to up CVE-2026-888258.8The iGMS Direct Booking WordPress plugin before 2.0 does not authorise or escape its widget appearance settings, allowing unauthenticated us