{"id":"CVE-2026-88811","published":"2026-11-02T17:17:45.793","lastModified":"2026-11-03T05:18:53.400","description":"Missing filtering in the SUSE Rancher Manager meta proxy could cause passed in rancher credentials to be leaked to cloud providers. This affects SUSE Rancher 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, 2.13.0 up to 2.13.11,","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwes":["CWE-201"],"vendors":[],"products":[],"references":[{"url":"https://github.com/rancher/rancher/security/advisories/GHSA-x82x-2qj6-5rm2","tags":[]}],"exploitRefs":[{"url":"https://github.com/rancher/rancher/security/advisories/GHSA-x82x-2qj6-5rm2","tags":[]}],"hasPoc":true,"ai":{"summary":"The SUSE Rancher Manager meta proxy lacks proper filtering of user-provided credentials, allowing attackers to inject or leak cloud provider credentials via the proxy when accessing Rancher services.","exploitability":"Exploitation requires network access to the Rancher meta proxy endpoint and knowledge of how to craft requests that bypass credential filtering; no authentication is required.","blast_radius":"Successful exploitation could lead to exposure of cloud provider credentials, enabling attackers to access or compromise cloud resources associated with the compromised Rancher instance.","remediation":"Upgrade to SUSE Rancher 2.15.4, 2.14.8, or 2.13.12 (or later) to apply the vendor-provided fix for credential filtering in the meta proxy.","detection":"Look for anomalous outbound requests from the Rancher meta proxy to cloud provider metadata endpoints (e.g., 169.254.169.254) or unexpected credential-related headers in proxy logs, especially when no legitimate cloud integration is configured.","tags":["credential-leak","proxy-bypass","cloud-apis","web","no-auth"],"model":"garnet-coder","analyzedAt":"2026-11-03T09:56:53.449Z"}}