CVE-2026-88804
Received Received - Intake

Stored XSS in SUSE Rancher UI via Unauthenticated Settings Update

Publication date: 2026-09-28

Last updated on: 2026-09-28

Assigner: SUSE

Description
An unauthenticated update of public UI settings could be used by remote attackers to execute a stored cross-site scripting attack in the Rancher UI, in SUSE Rancher 2.15 before 2.15.2, 2.14 before 2.14.6, 2.13 before 2.13.10, 2.12 before 2.12.14 and 2.11 before 2.11.18.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-28
Last Modified
2026-09-28
Generated
2026-09-28
AI Q&A
2026-09-28
EPSS Evaluated
N/A
NVD
CVE-2026-88804
EUVD
EUVD-2026-88340

Affected Vendors & Products

Showing 10 associated CPEs
Vendor Product Version / Range
suse rancher to 2.15.2 (exc)
suse rancher to 2.14.6 (exc)
suse rancher to 2.13.10 (exc)
suse rancher to 2.12.14 (exc)
suse rancher to 2.11.18 (exc)
suse rancher From 2.11.0 (inc) to 2.11.17 (inc)
suse rancher From 2.12.0 (inc) to 2.12.13 (inc)
suse rancher From 2.13.0 (inc) to 2.13.9 (inc)
suse rancher From 2.14.0 (inc) to 2.14.5 (inc)
suse rancher From 2.15.0 (inc) to 2.15.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-88804 is a critical stored cross-site scripting (XSS) vulnerability in SUSE Rancher. It allows unauthenticated remote attackers to modify public UI settings via the Norman API framework. These settings are rendered as raw HTML on the login page, enabling script injection that executes in users' browsers.

Detection Guidance

Check Rancher UI settings for unexpected HTML content or scripts in the login page. Inspect network traffic for unauthorized PUT or POST requests to public UI settings endpoints like /v3/publicsettings. Review logs for suspicious access patterns to these endpoints.

Impact Analysis

An attacker could steal the local administrator bootstrap password or hijack active administrator sessions, gaining full control over the Rancher installation and downstream clusters. Simply accessing the login page triggers the attack.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, including user credentials and session tokens, which may violate GDPR's data protection requirements and HIPAA's safeguards for protected health information. The stored XSS attack could expose personal or health data processed by Rancher, potentially resulting in non-compliance with these regulations.

Mitigation Strategies

Upgrade Rancher to a patched version (v2.11.18, v2.12.14, v2.13.10, v2.14.6, or v2.15.2). Restrict network access to trusted clients. Use a reverse proxy or WAF to block unauthorized requests to affected endpoints. Rotate the local administrator password and invalidate existing tokens.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88804. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart