{"id":"CVE-2026-88810","kind":"vulnerability","aliases":["CVE-2026-88810"],"related":[],"title":"Rancher Manager: role binding lets users gain permissions in downstream clusters","description":"A privilege escalation issue was discovered in Rancher Manager's role-based access control. The inheritedNamespacedRules field of a GlobalRole propagates permissions into named namespaces of every downstream cluster managed by the Rancher instance, but it was not subject to the privilege-escalation validation applied to the other permission-carrying fields of a GlobalRole. As a result, a non-administrative user could be granted, through a global role  binding, permissions in downstream clusters that exceed the permissions that user already holds. This affected SUSE Rancher 2.15.2 only, and SUSE Rancher Webhook 0.11.0 up to 0.11.4, and 0.12.0 up to 0.12.1.","summary":"Rancher Manager's GlobalRole field inheritedNamespacedRules skipped the privilege-escalation check, so a non-admin user can be granted more permissions in downstream clusters than they already hold. An attacker with a low-privilege Rancher account can gain elevated access to the clusters Rancher manages.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","kubernetes","rancher","suse-rancher"],"not_affected_if":["no-global-role-bindings-to-non-admins","other-rancher-versions"],"how_to_check":"- Check the Rancher Manager version; the sources name `2.15.2` as affected.\n- Check the SUSE Rancher Webhook version in the cluster; affected ranges are `0.11.0` through `0.11.4` and `0.12.0` through `0.12.1`.\n- Review GlobalRole objects for use of inheritedNamespacedRules.","fix":"- SUSE Rancher Webhook: move past `0.11.4` or `0.12.1` to a fixed release (the exact fixed version is not stated in the sources).\n- SUSE Rancher Manager `2.15.2`: unknown fixed version in the sources.","status":"open","published_at":"2026-11-02T17:17:45+00:00","first_seen_at":"2026-11-02T17:24:12+00:00","triaged_at":"2026-11-02T17:26:20+00:00","updated_at":"2026-11-02T17:26:20+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-02T17:26:20Z","model":"claude-haiku-5-5","output":{"fix":"- SUSE Rancher Webhook: move past `0.11.4` or `0.12.1` to a fixed release (the exact fixed version is not stated in the sources).\n- SUSE Rancher Manager `2.15.2`: unknown fixed version in the sources.","reach":"network","title":"Rancher Manager: role binding lets users gain permissions in downstream clusters","impact":"high","summary":"Rancher Manager's GlobalRole field inheritedNamespacedRules skipped the privilege-escalation check, so a non-admin user can be granted more permissions in downstream clusters than they already hold. An attacker with a low-privilege Rancher account can gain elevated access to the clusters Rancher manages.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["rancher","kubernetes","suse-rancher"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"low-privilege user gains elevated access in downstream Kubernetes clusters","analyst_note":"Confirm the fixed Rancher Manager and Webhook versions and the vendor advisory link (github.com) listed in the sources.","how_to_check":"- Check the Rancher Manager version; the sources name `2.15.2` as affected.\n- Check the SUSE Rancher Webhook version in the cluster; affected ranges are `0.11.0` through `0.11.4` and `0.12.0` through `0.12.1`.\n- Review GlobalRole objects for use of inheritedNamespacedRules.","plain_action":"","needs_analyst":true,"not_affected_if":["other-rancher-versions","no-global-role-bindings-to-non-admins"],"who_is_affected":"Teams running SUSE Rancher Manager 2.15.2 or a Rancher Webhook in the affected ranges, where non-admin users receive global role bindings. The flaw reaches named namespaces in every downstream cluster the Rancher instance manages. Installations on other Rancher versions, or without these webhook versions, are not named as affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000798,"input_tokens":4262,"output_tokens":743,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-88810':14A,17A '0.11.0':167C '0.11.4':170C '0.12.0':172C '0.12.1':175C '2.15.2':161C 'access':66B,85C 'account':62B 'admin':40B 'administr':135C 'affect':158C 'alreadi':52B,155C 'appli':118C 'attack':55B 'base':84C 'bind':4A,144C 'carri':124C 'check':35B 'cluster':11A,49B,69B,101C,148C 'control':86C 'could':137C 'cve':12A,15A 'discov':77C 'downstream':10A,48B,100C,147C 'elev':65B 'escal':34B,74C,116C 'everi':99C 'exceed':150C 'field':28B,89C,125C 'gain':7A,64B 'global':142C 'globalrol':27B,92C,128C 'grant':44B,139C 'hold':53B,156C 'infrastructur':18B 'inheritednamespacedrul':29B,88C 'instanc':106C 'issu':75C 'kubernet':19B 'let':5A 'low':59B 'low-privileg':58B 'manag':2A,25B,71B,80C,102C 'name':96C 'namespac':97C 'non':39B,134C 'non-admin':38B 'non-administr':133C 'permiss':8A,46B,94C,123C,145C,152C 'permission-carri':122C 'privileg':33B,60B,73C,115C 'privilege-escal':32B,114C 'propag':93C 'rancher':1A,20B,23B,24B,61B,70B,79C,105C,160C,165C 'result':131C 'role':3A,83C,143C 'role-bas':82C 'skip':30B 'subject':111C 'suse':22B,159C,164C 'suse-ranch':21B 'user':6A,41B,136C,154C 'valid':117C 'webhook':166C","nicknames":[],"mitigations":[],"who_affected":"Teams running SUSE Rancher Manager 2.15.2 or a Rancher Webhook in the affected ranges, where non-admin users receive global role bindings. The flaw reaches named namespaces in every downstream cluster the Rancher instance manages. Installations on other Rancher versions, or without these webhook versions, are not named as affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","kubernetes","rancher","suserancher"],"first_public_at":"2026-10-29T18:07:00+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"meissner@suse.de","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-88810","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88810","severity":null,"published_at":"2026-11-02T17:17:45+00:00","modified_at":"2026-11-02T17:17:45+00:00","first_seen_at":"2026-11-02T17:24:12+00:00","fetched_at":"2026-11-02T17:24:12+00:00","note":null}],"documents":[{"id":53012,"url":"https://github.com/rancher/webhook/security/advisories/GHSA-f898-2c8h-r7jc","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-29T18:07:00+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}