# CVE-2026-88804

Unauthenticated stored XSS in Rancher UI enabling remote script execution

- Page: https://www.vulneraibility.com/cve/CVE-2026-88804
- CVSS: 9.6
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 1.04% (percentile 64.4)
- Unvetted proof-of-concept code on GitHub: 1 GitHub proof of concept (first 2026-10-29)
- CISA SSVC: exploitation none, automatable no, technical impact total (assessed 2026-09-28)
- Weakness: CWE-79
- Also known as: GHSA-992f-xh8r-jg2f
- Published: 2026-09-28

## Affected versions

- SUSE Rancher: affected >= 2.15.0 and < 2.15.2; >= 2.14.0 and < 2.14.6; >= 2.13.0 and < 2.13.10; >= 2.12.0 and < 2.12.14; >= 2.11.0se and < 2.11.18

A version outside these ranges is not a statement that it is unaffected.

## Impact

Unauthenticated stored XSS; attackers can run JS in admin/user browsers, steal sessions, perform CSRF, and potentially compromise cluster management.

## Action

Immediate action required

## Recommendation

Upgrade to patched versions, restrict UI exposure, and rotate sessions/credentials.

## References

- [advisory] https://github.com/rancher/rancher/security/advisories/GHSA-992f-xh8r-jg2f

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.