Live › vulnerability › CVE-2026-88809
Rancher Manager's /meta/proxy endpoint logs when a destination fails its allowlist check but still forwards the request anyway. An attacker who can reach the endpoint can make the Rancher server send requests to destinations the allowlist was meant to block.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 16:24 UTC. All times on this page are UTC.
Self-hosted SUSE Rancher Manager in the affected ranges. The attacker must be an authenticated Rancher user (no admin rights needed) and must send an HTTP/1.1 request with the full destination URL in the request line that reaches Rancher without an HTTP-aware proxy rewriting it. Pods in the local cluster can always reach the Rancher Service directly, so an ingress controller is not a reliable control. Impact: reading internal services the Rancher server can reach, including cloud metadata credentials where IMDSv1 is on. Installs already on patched versions can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| rancher | vendor | >=2.11.0 <2.11.19, >=2.12.0 <2.12.15, >=2.13.0 <2.13.11, >=2.14.0 <2.14.7, >=2.15.0 <2.15.3 | 2.11.19, 2.12.15, 2.13.11, 2.14.7, 2.15.3 |
2.15.0 <2.15.3, >=2.14.0 <2.14.7, >=2.13.0 <2.13.11, >=2.12.0 <2.12.15, >=2.11.0 <2.11.19 (older EOL lines may be affected)Failed to proxy: for each attempt, but normal rejections log the same line, so logs cannot confirm abuse2.15.3, 2.14.7, 2.13.11, 2.12.15 or 2.11.19 (matching your minor line)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A security vulnerability exists in the SUSE Rancher Manager meta proxy endpoint (/meta/proxy). This endpoint is intended to forward requests only to destinations that appear on a configured allowlist. The allowlist decision was evaluated in a place where it could not stop a request from being forwarded, so a rejected destination was logged but the request was still handed to the proxy's transport. This affects SUSE Rancher 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, 2.13.0 up to 2.13.11, 2.12.0 up to 2.12.15, 2.11.0 up to 2.11.19 and potentially older EOL versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-88809")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.