Vulnerability in SUSE Rancher

[ Why it matters ]Priority signals

• Critical severity: CVSS 9.6

[ Description ]Official description

An unauthenticated update of public UI settings could be used by remote attackers to execute a stored cross-site scripting attack in the Rancher UI, in SUSE Rancher 2.15 before 2.15.2, 2.14 before 2.14.6, 2.13 before 2.13.10, 2.12 before 2.12.14 and 2.11 before 2.11.18.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund23 Sep 2026WID-SEC-2026-3541

  Rancher: Vulnerability allows cross-site scripting Translated from German

  CVE-2026-88804

[ References ]References

• github.com/rancher/rancher/security/advisories/GHSA-992f-xh8r-jg2f