Skip to content
OpenAdvisories
High WID-SEC-2026-4246 3 CVEs

Rancher: Mehrere Schwachstellen

Published Oct 29, 2026 · Updated Nov 2, 2026 · Revision 3 · de-DE

Vendor: rancher Product: rancher Platform: Linux

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Rancher ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Informationen auszulesen oder Daten zu manipulieren.

Product

Rancher ist ein Werkzeug für die Verwaltung von Kubernetes-Container basierten Umgebungen.

Vulnerabilities 3

  • Critical 9.1
    CVE-2026-88811

    Rancher credentials disclosed to third-party hosts by the Rancher Manager meta proxy

    Missing filtering in the SUSE Rancher Manager meta proxy could cause passed in rancher credentials to be leaked to cloud providers. This affects SUSE Rancher 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, 2.13.0 up to 2.13.11,

    SUSE Rancher
  • High 7.6
    CVE-2026-88809

    Rancher meta proxy allowlist bypass leading to server-side request forgery

    A security vulnerability exists in the SUSE Rancher Manager meta proxy endpoint (/meta/proxy). This endpoint is intended to forward requests only to  destinations that appear on a configured allowlist. The allowlist decision was evaluated in a  place where it…

    SUSE Rancher
  • Medium 6.3
    CVE-2026-104623 Public exploit

    Authorization bypass on the local cluster shell endpoint allows an unauthorized Rancher user to obtain a shell pod on the management cluster

    A security vulnerability exists in the authorization handling for the local (management) cluster shell feature of SUSE Rancher Manager 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, 2.13.0 up to 2.13.11, 2.12.0 up to 2.12.15, 2.11.0 up to 2.11.19 and possible olde…

    SUSE Rancher

Revision history

  1. #3

    Referenz(en) aufgenommen: EUVD-2026-115258, EUVD-2026-115330

  2. #2

    Referenz(en) aufgenommen: EUVD-2026-114186

  3. #1

    Initiale Fassung

References