CVE-2026-88804

Summary

The flaw allows unauthenticated attackers to execute a stored cross-site scripting attack in the Rancher UI, leading to potential data exfiltration, session hijacking, and other web-based attacks.

Exploitability

Exploitation is relatively easy given the unauthenticated nature and the stored nature of the XSS, requiring only the attacker to inject malicious content into the UI settings.

Blast radius

If exploited, the attack could impact any user interacting with the affected Rancher UI, leading to significant data loss or compromise.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to SUSE Rancher 2.15.2 or later, 2.14.6 or later, 2.13.10 or later, 2.12.14 or later, or 2.11.18 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.