CVE-2026-88804 Overview
CVE-2026-88804 is a stored cross-site scripting (XSS) vulnerability in the SUSE Rancher UI. Remote attackers can update public UI settings without authentication and inject malicious script content. When Rancher operators load the affected UI views, the injected payload executes in their browser session.
The flaw affects multiple Rancher 2.x release branches. Because Rancher administers Kubernetes clusters, script execution in an administrator context can lead to full control of managed workloads. The vulnerability is tracked under [CWE-79] and disclosed through a GitHub Security Advisory.
Critical Impact
Unauthenticated attackers can plant persistent scripts that hijack Rancher administrator sessions and pivot to managed Kubernetes clusters.
Affected Products
- SUSE Rancher 2.15 before 2.15.2
- SUSE Rancher 2.14 before 2.14.6
- SUSE Rancher 2.13 before 2.13.10, 2.12 before 2.12.14, and 2.11 before 2.11.18
Discovery Timeline
- 2026-09-28 - CVE-2026-88804 published to the National Vulnerability Database (NVD)
- 2026-09-29 - Last updated in NVD database
Technical Details for CVE-2026-88804
Vulnerability Analysis
The vulnerability lives in the Rancher UI settings subsystem. An endpoint that governs public UI settings accepts updates without validating the caller's authentication state. Attackers submit crafted values that persist in Rancher's backing store and render inside the UI without proper output encoding.
Because the payload is stored server-side, every user who subsequently loads the affected UI surface triggers execution. The scope changes from the vulnerable component to the browser, allowing the attacker to reach cookies, tokens, and Kubernetes API calls the operator is authorized to make.
Root Cause
Two distinct defects combine to produce the flaw. First, the public UI settings update path lacks an authentication and authorization check, so any unauthenticated network client can modify configuration. Second, values written through that path are rendered in the Rancher UI without proper sanitization or contextual output encoding, satisfying the classic stored XSS pattern captured in [CWE-79].
Attack Vector
An attacker with network reachability to a vulnerable Rancher server sends an HTTP request to the public UI settings endpoint containing a JavaScript payload. The value is persisted. When a Rancher administrator opens the UI, the browser executes the payload under the Rancher origin, giving the attacker access to session data, API tokens, and downstream cluster operations. No credentials or prior foothold are required to plant the payload; only administrator interaction is required to trigger it.
A proof-of-concept exploit has not been published. Technical details are available in the Rancher security advisory GHSA-992f-xh8r-jg2f.
Detection Methods for CVE-2026-88804
Indicators of Compromise
- Unexpected modifications to Rancher public UI settings, particularly values containing HTML tags, <script> blocks, javascript: URIs, or event handlers such as onerror and onload.
- Rancher audit log entries showing settings updates from unauthenticated sessions or unknown source IP addresses.
- Outbound requests from administrator browsers to unfamiliar domains shortly after loading the Rancher UI.
Detection Strategies
- Review current values of Rancher public UI settings against a known-good baseline and flag any entries with markup or script content.
- Inspect reverse proxy and ingress logs for unauthenticated PUT or POST requests to Rancher settings endpoints.
- Enable Content Security Policy (CSP) reporting on the Rancher origin to surface inline script executions that violate policy.
Monitoring Recommendations
- Alert on any change to Rancher UI settings outside of approved change windows.
- Correlate Rancher API access with administrator session activity to identify token reuse from unexpected clients.
- Monitor Kubernetes API audit logs for privileged actions initiated shortly after suspicious Rancher UI activity.
How to Mitigate CVE-2026-88804
Immediate Actions Required
- Upgrade Rancher to a fixed release: 2.15.2, 2.14.6, 2.13.10, 2.12.14, or 2.11.18, depending on the branch in use.
- Restrict network access to the Rancher management plane so only trusted operator networks can reach the UI and API.
- Audit and reset any public UI settings that contain untrusted content, then rotate administrator session tokens.
Patch Information
SUSE has released fixed versions in each supported branch. Upgrade to Rancher 2.15.2 or later, 2.14.6 or later, 2.13.10 or later, 2.12.14 or later, or 2.11.18 or later. Consult the Rancher security advisory GHSA-992f-xh8r-jg2f for full release notes and upgrade guidance.
Workarounds
- Place Rancher behind an authenticating reverse proxy or VPN so the settings endpoint cannot be reached by unauthenticated clients.
- Apply a strict Content Security Policy on the Rancher origin that blocks inline scripts and untrusted script sources.
- Require administrators to use dedicated browser profiles for Rancher to limit the blast radius of a hijacked session.
# Example Helm upgrade to a fixed Rancher release
helm upgrade rancher rancher-stable/rancher \
--namespace cattle-system \
--version 2.15.2
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
