CVE-2026-104623Medium· 6.3▾ TwilightPoC availableA security vulnerability exists in the authorization handling for the local (management) cluster shell feature of SUSE Rancher Manager 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, 2.13.0 up to 2.13.11, 2.12.0 up to 2.12.15, 2.11.0 up to 2.1…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 34.7 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
1 GitHub repo (last check)
A security vulnerability exists in the authorization handling for the local (management) cluster shell feature of SUSE Rancher Manager 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, 2.13.0 up to 2.13.11, 2.12.0 up to 2.12.15, 2.11.0 up to 2.11.19 and possible older versions. The authorization check that was introduced to protect this feature was not applied to every API route that can reach it, so an alternative request form reached the shell handler without the access check being evaluated. This could allow any authenticated users to run a pod on the management cluster.
Rancher >= 2.15.0 < 2.15.3Rancher >= 2.14.0 < 2.14.7Rancher >= 2.13.0 < 2.13.11Rancher >= 2.12.0 < 2.12.15Rancher >= 2.11.0 < 2.11.19Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-88804Critical· 9.6An unauthenticated update of public UI settings could be used by remote attackers to execute a stored cross-site scripting attack in the Rancher UI, in SUSE Rancher 2.15 before 2.15.2, 2.14 before 2.14.6, 2.13 before 2.13.10, 2.12 before…
CVE-2026-88811Critical· 9.1Rancher credentials disclosed to third-party hosts by the Rancher Manager meta proxy
CVE-2026-88810High· 7.2Privilege escalation in downstream clusters via GlobalRole inheritedNamespacedRules
CVE-2026-88809High· 7.6Rancher meta proxy allowlist bypass leading to server-side request forgery
CVE-2026-104615High· 7.9Cluster identity takeover in Fleet cluster registration allows access to another cluster's Fleet namespace
CVE-2026-44945Critical· 9.1A privilege escalation vulnerability exists in Rancher's impersonation middleware (pkg/auth/requests/impersonate.go)