CVE-2026-88811

{
  "etk_id": "ETK-2026-3299",
  "cve_id": "CVE-2026-88811",
  "display_id": "CVE-2026-88811",
  "ghsa_id": "GHSA-x82x-2qj6-5rm2",
  "euvd_id": "EUVD-2026-115330",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Credential forwarding flaw in SUSE Rancher meta proxy",
  "summary": "SUSE Rancher Manager's meta proxy may forward Rancher credentials to external cloud providers because requests are not filtered adequately. An attacker able to cause use of the affected proxy path could expose those credentials to a third party.",
  "mitigation": "Upgrade Rancher to 2.15.3, 2.14.7, 2.13.11, 2.12.15, or 2.11.19, selecting the fixed release for your supported branch. Until upgraded, restrict use of the meta proxy for requests to untrusted external providers.",
  "vendor": "SUSE",
  "product": "Rancher",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">=2.15.0",
        "<2.15.3"
      ],
      "ecosystem": "go",
      "fixed_versions": [
        "2.15.3"
      ],
      "package_name": "github.com/rancher/rancher",
      "purl": "pkg:golang/github.com/rancher/rancher"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">=2.14.0",
        "<2.14.7"
      ],
      "ecosystem": "go",
      "fixed_versions": [
        "2.14.7"
      ],
      "package_name": "github.com/rancher/rancher",
      "purl": "pkg:golang/github.com/rancher/rancher"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">=2.13.0",
        "<2.13.11"
      ],
      "ecosystem": "go",
      "fixed_versions": [
        "2.13.11"
      ],
      "package_name": "github.com/rancher/rancher",
      "purl": "pkg:golang/github.com/rancher/rancher"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">=2.12.0",
        "<2.12.15"
      ],
      "ecosystem": "go",
      "fixed_versions": [
        "2.12.15"
      ],
      "package_name": "github.com/rancher/rancher",
      "purl": "pkg:golang/github.com/rancher/rancher"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">=2.11.0",
        "<2.11.19"
      ],
      "ecosystem": "go",
      "fixed_versions": [
        "2.11.19"
      ],
      "package_name": "github.com/rancher/rancher",
      "purl": "pkg:golang/github.com/rancher/rancher"
    }
  ],
  "cwes": [
    201
  ],
  "cvss_score": 9.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 53.23461141666667,
  "t0_at": "2026-11-02T16:48:44.799000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-02T16:48:44.799000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-02T16:48:44.799000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-88811"
    }
  }
}