---
id: "CVE-2026-88810"
kind: "vulnerability"
aliases: ["CVE-2026-88810"]
title: "Rancher Manager: role binding lets users gain permissions in downstream clusters"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "kubernetes", "rancher", "suse-rancher"]
not_affected_if: ["no-global-role-bindings-to-non-admins", "other-rancher-versions"]
published_at: "2026-11-02T17:17:45+00:00"
first_seen_at: "2026-11-02T17:24:12+00:00"
updated_at: "2026-11-02T17:26:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88810", "first_seen_at": "2026-11-02T17:24:12+00:00"}]
---

# Rancher Manager: role binding lets users gain permissions in downstream clusters

Rancher Manager's GlobalRole field inheritedNamespacedRules skipped the privilege-escalation check, so a non-admin user can be granted more permissions in downstream clusters than they already hold. An attacker with a low-privilege Rancher account can gain elevated access to the clusters Rancher manages.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Rancher Manager version; the sources name `2.15.2` as affected.
- Check the SUSE Rancher Webhook version in the cluster; affected ranges are `0.11.0` through `0.11.4` and `0.12.0` through `0.12.1`.
- Review GlobalRole objects for use of inheritedNamespacedRules.

## Fix

- SUSE Rancher Webhook: move past `0.11.4` or `0.12.1` to a fixed release (the exact fixed version is not stated in the sources).
- SUSE Rancher Manager `2.15.2`: unknown fixed version in the sources.

## Timeline

- 2026-11-02T17:24:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-88810

## Documents

- [advisory] Vendor advisory: github.com https://github.com/rancher/webhook/security/advisories/GHSA-f898-2c8h-r7jc

## From the sources

A privilege escalation issue was discovered in Rancher Manager's role-based access control. The inheritedNamespacedRules field of a GlobalRole propagates permissions into named namespaces of every downstream cluster managed by the Rancher instance, but it was not subject to the privilege-escalation validation applied to the other permission-carrying fields of a GlobalRole. As a result, a non-administrative user could be granted, through a global role  binding, permissions in downstream clusters that exceed the permissions that user already holds. This affected SUSE Rancher 2.15.2 only, and SUSE Rancher Webhook 0.11.0 up to 0.11.4, and 0.12.0 up to 0.12.1.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_