CVE-2026-88809
Rancher meta proxy allowlist bypass leading to server-side request forgery
CVSS Score
7.6
EPSS Score
0.0%
EPSS Percentile
0th
A security vulnerability exists in the SUSE Rancher Manager meta proxy endpoint (/meta/proxy). This endpoint is intended to forward requests only to destinations that appear on a configured allowlist. The allowlist decision was evaluated in a place where it could not stop a request from being forwarded, so a rejected destination was logged but the request was still handed to the proxy's transport. This affects SUSE Rancher 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, 2.13.0 up to 2.13.11, 2.12.0 up to 2.12.15, 2.11.0 up to 2.11.19 and potentially older EOL versions.
| CWE | CWE-918 |
| Vendor | suse |
| Product | rancher |
| Published | Nov 2, 2026 |
Stay Ahead of the Next One
Get instant alerts for suse rancher
Be the first to know when new high vulnerabilities affecting suse rancher are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
Low
Availability
None
Affected Versions
SUSE / Rancher
2.15.0 < 2.15.3 2.14.0 < 2.14.7 2.13.0 < 2.13.11 2.12.0 < 2.12.15 2.11.0 < 2.11.19
References
Credits
김도현 <[email protected]