CVE-2026-88811

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-88811
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-88811.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-88811
Aliases
  • GHSA-x82x-2qj6-5rm2
Published
2026-11-02T16:48:44Z
Modified
2026-11-03T02:47:34Z
Severity
  • 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
Rancher credentials disclosed to third-party hosts by the Rancher Manager meta proxy
Details

Missing filtering in the SUSE Rancher Manager meta proxy could cause passed in rancher credentials to be leaked to cloud providers. This affects SUSE Rancher 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, 2.13.0 up to 2.13.11,

Database specific 
{
    "cna_assigner": "suse",
    "cwe_ids": [
        "CWE-201"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/88xxx/CVE-2026-88811.json"
}
References

Affected packages

Git / github.com/rancher/rancher

Affected ranges

Type
GIT
Repo
https://github.com/rancher/rancher
Events
Introduced
9994cd93198c4b1692bcda733eb08d1e81c26eed
Fixed
99ab89e90bf1d048f3f7acf7f05b132bf5a23a8e
Introduced
19d8a9c03fde57ab691101dc90a17b92c55f09ad
Fixed
ba14fe8e3c424dd43d8244ce1045eadf8b56548d
Introduced
f94ac947f75e312f1ab9217d21b2770b48b734c8
Fixed
b558a03856396ce632c13e796b9f3e39f59aa59b
Introduced
8815e66bf2e4b528493cf11222f1a63f86305a9f
Fixed
3fc4d0823ac31a1e5b8120caeb7bce0ee9127367
Introduced
4b8ab8c48d681f77065bf25e1fa502c652b94465
Fixed
a1d8b3f56defd6c690fc1e253d7df27ada1c6253
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "2.15.0"
                },
                {
                    "fixed": "2.15.3"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "introduced": "2.14.0"
                },
                {
                    "fixed": "2.14.7"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "introduced": "2.13.0"
                },
                {
                    "fixed": "2.13.11"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "introduced": "2.12.0"
                },
                {
                    "fixed": "2.12.15"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "introduced": "2.11.0"
                },
                {
                    "fixed": "2.11.19"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        }
    ]
}

Affected versions

v2.*
v2.11.0
v2.11.1
v2.11.1-alpha1
v2.11.1-alpha2
v2.11.1-alpha3
v2.11.1-rc1
v2.11.1-rc2
v2.11.10
v2.11.10-alpha1
v2.11.10-rc1
v2.11.10-rc2
v2.11.11
v2.11.11-alpha1
v2.11.11-alpha2
v2.11.11-rc1
v2.11.12
v2.11.12-alpha1
v2.11.12-rc1
v2.11.13
v2.11.13-alpha1
v2.11.13-alpha2
v2.11.13-alpha3
v2.11.13-alpha4
v2.11.13-alpha5
v2.11.13-alpha6
v2.11.13-rc1
v2.11.14
v2.11.14-alpha1
v2.11.14-rc1
v2.11.15
v2.11.15-alpha1
v2.11.15-alpha2
v2.11.15-alpha3
v2.11.15-alpha4
v2.11.15-rc1
v2.11.16
v2.11.16-alpha1
v2.11.16-alpha2
v2.11.16-alpha3
v2.11.16-alpha4
v2.11.16-alpha5
v2.11.16-alpha6
v2.11.16-rc1
v2.11.17
v2.11.17-alpha1
v2.11.17-rc1
v2.11.18
v2.11.18-rc1
v2.11.19-rc1
v2.11.2
v2.11.2-alpha1
v2.11.2-alpha2
v2.11.2-alpha3
v2.11.2-alpha4
v2.11.2-rc1
v2.11.2-rc2
v2.11.3
v2.11.3-alpha1
v2.11.3-alpha2
v2.11.3-alpha3
v2.11.3-rc1
v2.11.4
v2.11.4-alpha1
v2.11.4-alpha2
v2.11.4-alpha3
v2.11.4-alpha4
v2.11.4-alpha5
v2.11.4-rc1
v2.11.5
v2.11.5-alpha1
v2.11.5-alpha2
v2.11.5-alpha3
v2.11.5-rc1
v2.11.6
v2.11.6-alpha1
v2.11.6-alpha2
v2.11.6-alpha3
v2.11.6-alpha4
v2.11.6-rc1
v2.11.7
v2.11.7-alpha1
v2.11.7-alpha2
v2.11.7-rc1
v2.11.7-rc2
v2.11.8
v2.11.8-alpha1
v2.11.8-alpha2
v2.11.8-alpha3
v2.11.8-alpha4
v2.11.8-alpha5
v2.11.8-rc1
v2.11.9
v2.11.9-alpha1
v2.11.9-alpha2
v2.11.9-rc1
v2.12.0
v2.12.1
v2.12.1-alpha1
v2.12.1-alpha2
v2.12.1-alpha3
v2.12.1-alpha4
v2.12.1-rc1
v2.12.10
v2.12.10-alpha1
v2.12.10-alpha2
v2.12.10-alpha3
v2.12.10-alpha4
v2.12.10-alpha5
v2.12.10-rc1
v2.12.11
v2.12.11-alpha1
v2.12.11-alpha2
v2.12.11-alpha3
v2.12.11-alpha4
v2.12.11-alpha5
v2.12.11-rc1
v2.12.12
v2.12.12-alpha1
v2.12.12-alpha2
v2.12.12-alpha3
v2.12.12-alpha4
v2.12.12-alpha5
v2.12.12-alpha6
v2.12.12-alpha7
v2.12.12-alpha8
v2.12.12-alpha9
v2.12.12-rc1
v2.12.13
v2.12.13-alpha1
v2.12.13-rc1
v2.12.14
v2.12.14-rc1
v2.12.15-rc1
v2.12.2
v2.12.2-alpha1
v2.12.2-alpha2
v2.12.2-alpha3
v2.12.2-alpha4
v2.12.2-alpha5
v2.12.2-rc1
v2.12.2-rc2
v2.12.3
v2.12.3-alpha1
v2.12.3-alpha2
v2.12.3-rc1
v2.12.4
v2.12.4-alpha1
v2.12.4-alpha2
v2.12.4-alpha3
v2.12.4-alpha4
v2.12.4-alpha5
v2.12.4-alpha6
v2.12.4-hotfix-a3c0.1
v2.12.4-rc1
v2.12.5
v2.12.5-alpha1
v2.12.5-alpha2
v2.12.5-rc1
v2.12.6
v2.12.6-alpha1
v2.12.6-alpha2
v2.12.6-rc1
v2.12.6-rc2
v2.12.7
v2.12.7-alpha1
v2.12.7-alpha2
v2.12.7-alpha3
v2.12.7-rc1
v2.12.8
v2.12.8-alpha1
v2.12.8-alpha2
v2.12.8-rc1
v2.12.9
v2.12.9-alpha1
v2.12.9-alpha2
v2.12.9-alpha3
v2.12.9-alpha4
v2.12.9-alpha5
v2.12.9-alpha6
v2.12.9-alpha7
v2.12.9-rc1
v2.13.0
v2.13.0-rc4
v2.13.1
v2.13.1-alpha1
v2.13.1-alpha2
v2.13.1-alpha3
v2.13.1-alpha4
v2.13.1-alpha5
v2.13.1-alpha6
v2.13.1-alpha7
v2.13.1-rc1
v2.13.10
v2.13.10-rc1
v2.13.11-rc1
v2.13.2
v2.13.2-alpha1
v2.13.2-alpha2
v2.13.2-alpha3
v2.13.2-alpha4
v2.13.2-alpha5
v2.13.2-alpha6
v2.13.2-alpha7
v2.13.2-rc1
v2.13.2-rc2
v2.13.3
v2.13.3-alpha1
v2.13.3-alpha2
v2.13.3-alpha3
v2.13.3-alpha4
v2.13.3-alpha5
v2.13.3-alpha6
v2.13.3-rc1
v2.13.3-rc2
v2.13.3-rc3
v2.13.4
v2.13.4-alpha1
v2.13.4-alpha2
v2.13.4-alpha3
v2.13.4-alpha4
v2.13.4-alpha5
v2.13.4-rc1
v2.13.5
v2.13.5-alpha1
v2.13.5-alpha2
v2.13.5-alpha3
v2.13.5-alpha4
v2.13.5-alpha5
v2.13.5-alpha6
v2.13.5-alpha7
v2.13.5-rc1
v2.13.6
v2.13.6-alpha1
v2.13.6-alpha2
v2.13.6-alpha3
v2.13.6-alpha4
v2.13.6-alpha5
v2.13.6-alpha6
v2.13.6-rc1
v2.13.7
v2.13.7-alpha1
v2.13.7-alpha2
v2.13.7-alpha3
v2.13.7-alpha4
v2.13.7-alpha5
v2.13.7-alpha6
v2.13.7-alpha7
v2.13.7-rc1
v2.13.8
v2.13.8-alpha1
v2.13.8-alpha2
v2.13.8-alpha3
v2.13.8-alpha4
v2.13.8-alpha5
v2.13.8-alpha6
v2.13.8-alpha7
v2.13.8-alpha8
v2.13.8-rc1
v2.13.9
v2.13.9-alpha1
v2.13.9-rc1
v2.13.9-rc2
v2.14.0
v2.14.1
v2.14.1-alpha1
v2.14.1-alpha10
v2.14.1-alpha11
v2.14.1-alpha12
v2.14.1-alpha13
v2.14.1-alpha14
v2.14.1-alpha2
v2.14.1-alpha3
v2.14.1-alpha4
v2.14.1-alpha5
v2.14.1-alpha6
v2.14.1-alpha7
v2.14.1-alpha8
v2.14.1-alpha9
v2.14.1-rc1
v2.14.1-rc2
v2.14.2
v2.14.2-alpha1
v2.14.2-alpha2
v2.14.2-alpha3
v2.14.2-alpha4
v2.14.2-alpha5
v2.14.2-alpha6
v2.14.2-alpha7
v2.14.2-alpha8
v2.14.2-rc1
v2.14.3
v2.14.3-alpha1
v2.14.3-alpha2
v2.14.3-alpha3
v2.14.3-alpha4
v2.14.3-alpha5
v2.14.3-alpha6
v2.14.3-rc1
v2.14.4
v2.14.4-alpha1
v2.14.4-alpha2
v2.14.4-alpha3
v2.14.4-alpha4
v2.14.4-alpha5
v2.14.4-alpha6
v2.14.4-alpha7
v2.14.4-rc1
v2.14.5
v2.14.5-alpha1
v2.14.5-rc1
v2.14.5-rc2
v2.14.6
v2.14.6-rc1
v2.14.7-rc1
v2.15.0
v2.15.1
v2.15.1-alpha1
v2.15.1-rc1
v2.15.1-rc2
v2.15.2
v2.15.2-rc1
v2.15.3-rc1
v2.15.3-rc2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-88811.json"