# CVE-2026-88811

Rancher meta-proxy can leak Rancher credentials to cloud providers.

- Page: https://www.vulneraibility.com/cve/CVE-2026-88811
- CVSS: 9.1
- Known exploited: not in CISA KEV as of our last sync
- CISA SSVC: exploitation none, automatable yes, technical impact total (assessed 2026-11-02)
- Weakness: CWE-201
- Also known as: GHSA-x82x-2qj6-5rm2
- Published: 2026-11-02

## Affected versions

- SUSE Rancher: affected >= 2.15.0 and < 2.15.3; >= 2.14.0 and < 2.14.7; >= 2.13.0 and < 2.13.11; >= 2.12.0 and < 2.12.15; >= 2.11.0 and < 2.11.19

A version outside these ranges is not a statement that it is unaffected.

## Impact

Disclosure of Rancher credentials to cloud providers, enabling account takeover, cluster access, and data exfiltration.

## Action

Immediate action required

## Recommendation

Prepare to apply vendor patch, rotate affected credentials, restrict proxy access and audit cloud accounts.

## References

- [advisory] https://github.com/rancher/rancher/security/advisories/GHSA-x82x-2qj6-5rm2

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.