SUSE fixes Rancher flaws exposing cloud credentials and shells

SUSE has issued security updates to fix three serious Rancher vulnerabilities discovered in late October 2026, with patches released on 29 October 2026. The flaws enable credential leakage and request forgery, and they also permit unauthorized shell access on admin clusters. The advisory notes that attackers could breach cloud nodes and view user data, though there have been no confirmed public exploits at the time of reporting.

The three CVEs are CVE-2026-88811, CVE-2026-88809 and CVE-2026-104623, all rated with high to critical impact and associated with the Rancher Manager meta proxy and cluster shell access. The vulnerabilities affect Rancher versions 2.11 through 2.15, specifically before the fixes in 2.15.3, 2.14.7, 2.13.11, 2.12.15 and 2.11.19.

The gist of the issues is as follows: CVE-2026-88811 (9.1 CVSSv3) involves credential leakage in the meta proxy when forwarding requests to third-party hosts, potentially exposing cookies and API tokens. CVE-2026-88809 (7.6 CVSSv3) is an SSRF flaw allowing a logged-in user to bypass the allowlist in the meta proxy and query internal services, risking access to cloud instance metadata keys.

CVE-2026-104623 (6.3 CVSSv3) is an authorization bypass on the local cluster shell endpoint, enabling a logged-in user to launch a shell pod in cattle-system with standard rights. SUSE’s fixes are contained in the stated patched releases, and admins are instructed to update to the corresponding version and rotate any API tokens used with the proxy, while checking for unknown shell pods in the cattle-system namespace. The report attributes each claim to SUSE’s patch advisory and GHSA security advisories cited.