{"id":"CVE-2026-88811","kind":"vulnerability","aliases":["CVE-2026-88811"],"related":[],"title":"SUSE Rancher Manager: meta proxy leaks credentials to cloud providers","description":"Missing filtering in the SUSE Rancher Manager meta proxy could cause passed in rancher credentials to be leaked to cloud providers. This affects SUSE Rancher 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, 2.13.0 up to 2.13.11,","summary":"SUSE Rancher Manager's meta proxy fails to filter credentials passed in requests, so Rancher credentials can be sent on to cloud providers. An attacker who can reach that traffic path gets those credentials.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cloud","infrastructure","kubernetes","rancher","suse"],"not_affected_if":["unknown"],"how_to_check":"- Check the installed Rancher Manager version against the affected ranges (2.15.0 to 2.15.3, 2.14.0 to 2.14.7, 2.13.0 to 2.13.11).\n- Whether the meta proxy is in use in your deployment is unknown from the sources.","fix":"- Move to a fixed release in the 2.15, 2.14 or 2.13 line; the exact fixed versions are unknown from the sources.","status":"open","published_at":"2026-11-02T17:17:45+00:00","first_seen_at":"2026-11-02T17:24:12+00:00","triaged_at":"2026-11-02T17:26:19+00:00","updated_at":"2026-11-02T17:26:19+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-02T17:26:19Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a fixed release in the 2.15, 2.14 or 2.13 line; the exact fixed versions are unknown from the sources.","reach":"unknown","title":"SUSE Rancher Manager: meta proxy leaks credentials to cloud providers","impact":"high","summary":"SUSE Rancher Manager's meta proxy fails to filter credentials passed in requests, so Rancher credentials can be sent on to cloud providers. An attacker who can reach that traffic path gets those credentials.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["rancher","kubernetes","suse","cloud"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Rancher credentials leak to cloud providers, exposing the credentials to third parties","analyst_note":"Fetch the vendor advisory linked in the sources for fixed versions, the affected-range list and the exact meta proxy conditions.","how_to_check":"- Check the installed Rancher Manager version against the affected ranges (2.15.0 to 2.15.3, 2.14.0 to 2.14.7, 2.13.0 to 2.13.11).\n- Whether the meta proxy is in use in your deployment is unknown from the sources.","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Teams running SUSE Rancher Manager in the affected version ranges, where the meta proxy forwards requests to cloud providers. The sources do not say which deployment setups are exposed, and the description is cut off before the full range list.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000713,"input_tokens":4153,"output_tokens":596,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-88811':13A,16A '2.13.0':89C '2.13.11':92C '2.14.0':85C '2.14.7':88C '2.15.0':81C '2.15.3':84C 'affect':78C 'attack':46B 'caus':66C 'cloud':9A,17B,43B,75C 'could':65C 'credenti':7A,31B,37B,55B,70C 'cve':11A,14A 'fail':28B 'filter':30B,57C 'get':53B 'infrastructur':18B 'kubernet':19B 'leak':6A,73C 'manag':3A,24B,62C 'meta':4A,26B,63C 'miss':56C 'pass':32B,67C 'path':52B 'provid':10A,44B,76C 'proxi':5A,27B,64C 'rancher':2A,20B,23B,36B,61C,69C,80C 'reach':49B 'request':34B 'sent':40B 'suse':1A,21B,22B,60C,79C 'traffic':51B","nicknames":[],"mitigations":[],"who_affected":"Teams running SUSE Rancher Manager in the affected version ranges, where the meta proxy forwards requests to cloud providers. The sources do not say which deployment setups are exposed, and the description is cut off before the full range list.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["cloud","critical","infrastructure","kubernetes","rancher","suse"],"first_public_at":"2026-10-29T17:26:42+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"meissner@suse.de","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-88811","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88811","severity":null,"published_at":"2026-11-02T17:17:45+00:00","modified_at":"2026-11-02T17:17:45+00:00","first_seen_at":"2026-11-02T17:24:12+00:00","fetched_at":"2026-11-02T17:24:12+00:00","note":null}],"documents":[{"id":53013,"url":"https://github.com/rancher/rancher/security/advisories/GHSA-x82x-2qj6-5rm2","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-29T17:26:42+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}