{"id":"CVE-2026-88811","title":"Rancher credentials disclosed to third-party hosts by the Rancher Manager meta proxy","summary":"Missing filtering in the SUSE Rancher Manager meta proxy could cause passed in rancher credentials to be leaked to cloud providers. This affects SUSE Rancher 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, 2.13.0 up to 2.13.11,","severity":"critical","cvss":9.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cvssSource":"cna","cwe":["CWE-201"],"vendor":"SUSE","product":"Rancher","affected":["Rancher >= 2.15.0 < 2.15.3","Rancher >= 2.14.0 < 2.14.7","Rancher >= 2.13.0 < 2.13.11","Rancher >= 2.12.0 < 2.12.15","Rancher >= 2.11.0 < 2.11.19"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total","timestamp":"2026-11-02T00:00:00+00:00"},"published":"2026-11-02","updated":"2026-11-03","sourceUpdated":"2026-11-03T04:55:53.397Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-88811","references":[{"url":"https://github.com/rancher/rancher/security/advisories/GHSA-x82x-2qj6-5rm2"}],"tags":["cve.org"],"epss":0.00427,"epssPercentile":0.3708,"ingestedAt":"2026-11-05T19:30:42.908Z","slug":"CVE-2026-88811","body":"## Overview\n\nMissing filtering in the SUSE Rancher Manager meta proxy could cause passed in rancher credentials to be leaked to cloud providers. This affects SUSE Rancher 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, 2.13.0 up to 2.13.11,\n\n## Affected\n\n- `Rancher >= 2.15.0 < 2.15.3`\n- `Rancher >= 2.14.0 < 2.14.7`\n- `Rancher >= 2.13.0 < 2.13.11`\n- `Rancher >= 2.12.0 < 2.12.15`\n- `Rancher >= 2.11.0 < 2.11.19`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":50,"depthScoreParts":{"impact":50.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}