CVE-2026-88811

Summary

The SUSE Rancher Manager meta proxy lacks proper filtering of user-provided credentials, allowing attackers to inject or leak cloud provider credentials via the proxy when accessing Rancher services.

Exploitability

Exploitation requires network access to the Rancher meta proxy endpoint and knowledge of how to craft requests that bypass credential filtering; no authentication is required.

Blast radius

Successful exploitation could lead to exposure of cloud provider credentials, enabling attackers to access or compromise cloud resources associated with the compromised Rancher instance.

Detection

Look for anomalous outbound requests from the Rancher meta proxy to cloud provider metadata endpoints (e.g., 169.254.169.254) or unexpected credential-related headers in proxy logs, especially when no legitimate cloud integration is configured.

Prioritized remediation

Upgrade to SUSE Rancher 2.15.4, 2.14.8, or 2.13.12 (or later) to apply the vendor-provided fix for credential filtering in the meta proxy.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.