# CVE-2026-88805

Rancher logout fails to clear credentials, allowing retained access.

- Page: https://www.vulneraibility.com/cve/CVE-2026-88805
- CVSS: 8.1
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 0.25% (percentile 16.5)
- CISA SSVC: exploitation none, automatable no, technical impact total (assessed 2026-09-28)
- Weakness: CWE-613
- Also known as: GHSA-6vpq-mf48-9794
- Published: 2026-09-28

## Affected versions

- SUSE Rancher: affected >= 2.15.0 and < 2.15.2

A version outside these ranges is not a statement that it is unaffected.

## Impact

Remote attackers can retain credentials after logout, enabling unauthorized access and control of Rancher and managed clusters.

## Action

Immediate action required

## Recommendation

Upgrade Rancher to 2.15.2 immediately

## References

- [advisory] https://github.com/rancher/rancher/security/advisories/GHSA-6vpq-mf48-9794

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.