CVE-2026-88804: Unauthenticated update of public UI settings leading to stored cross-site scripting in Rancher
An unauthenticated update of public UI settings could be used by remote attackers to execute a stored cross-site scripting attack in the Rancher UI, in SUSE Rancher 2.15 before 2.15.2, 2.14 before 2.14.6, 2.13 before 2.13.10, 2.12 before 2.12.14 and 2.11 before 2.11.18.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SUSE Rancherto a version that resolves this vulnerability.Fixed in 2.15.2 - Upgrade
Upgrade
SUSE Rancherto a version that resolves this vulnerability.Fixed in 2.14.6 - Upgrade
Upgrade
SUSE Rancherto a version that resolves this vulnerability.Fixed in 2.13.10 - Upgrade
Upgrade
SUSE Rancherto a version that resolves this vulnerability.Fixed in 2.12.14 - Upgrade
Upgrade
SUSE Rancherto a version that resolves this vulnerability.Fixed in 2.11.18
Event History
Frequently Asked Questions
Which Rancher releases are affected, and what versions contain the fix?
Affected releases are SUSE Rancher 2.15 before 2.15.2, 2.14 before 2.14.6, 2.13 before 2.13.10, 2.12 before 2.12.14, and 2.11 before 2.11.18. Upgrade to the applicable listed version or later.
Does exploitation require authentication or privileged access?
No. The issue allows unauthenticated remote attackers to update public UI settings, but exploitation requires user interaction for the stored cross-site scripting payload to execute in the Rancher UI.
What is the potential impact of a successful attack?
A successful stored cross-site scripting attack can execute attacker-supplied script in the Rancher UI. The provided severity vector indicates high confidentiality, integrity, and availability impact, with scope changed.