---
id: "CVE-2026-88811"
kind: "vulnerability"
aliases: ["CVE-2026-88811"]
title: "SUSE Rancher Manager: meta proxy leaks credentials to cloud providers"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["cloud", "infrastructure", "kubernetes", "rancher", "suse"]
not_affected_if: ["unknown"]
published_at: "2026-11-02T17:17:45+00:00"
first_seen_at: "2026-11-02T17:24:12+00:00"
updated_at: "2026-11-02T17:26:19+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88811", "first_seen_at": "2026-11-02T17:24:12+00:00"}]
---

# SUSE Rancher Manager: meta proxy leaks credentials to cloud providers

SUSE Rancher Manager's meta proxy fails to filter credentials passed in requests, so Rancher credentials can be sent on to cloud providers. An attacker who can reach that traffic path gets those credentials.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Rancher Manager version against the affected ranges (2.15.0 to 2.15.3, 2.14.0 to 2.14.7, 2.13.0 to 2.13.11).
- Whether the meta proxy is in use in your deployment is unknown from the sources.

## Fix

- Move to a fixed release in the 2.15, 2.14 or 2.13 line; the exact fixed versions are unknown from the sources.

## Timeline

- 2026-11-02T17:24:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-88811

## Documents

- [advisory] Vendor advisory: github.com https://github.com/rancher/rancher/security/advisories/GHSA-x82x-2qj6-5rm2

## From the sources

Missing filtering in the SUSE Rancher Manager meta proxy could cause passed in rancher credentials to be leaked to cloud providers. This affects SUSE Rancher 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, 2.13.0 up to 2.13.11,

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_