External risk intelligence

Rancher UI Stored Cross-Site Scripting Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-88804

SUSE Rancher is a management platform for Kubernetes clusters, which is commonly deployed as an internet-facing administrative web interface. While specific exposure depends on organization policy, these management portals are frequently exposed to the internet to facilitate remote cluster management and access.

Cross-site Scripting

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the Rancher UI, a management platform for Kubernetes clusters. This flaw allows unauthenticated remote attackers to execute malicious code by manipulating public settings, potentially impacting the integrity and confidentiality of the system. The main concern at this stage is confirming the relevance and exposure of this technology within our environment.

Attackers could run code via UI settings.
Important for managing Kubernetes clusters.
Assess our use of Rancher for exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted requests to the Rancher UI. Since no authentication is required, a remote attacker could manipulate public UI settings to inject malicious scripts. If successful, this could lead to the execution of stored cross-site scripting attacks, potentially impacting users who interact with the compromised UI.

Unauthenticated remote access to the UI.
Updating public UI settings.
Stored cross-site scripting attack.

Live Threat

Current exploitation, exposure, and threat context

A stored cross-site scripting vulnerability in the Rancher UI could allow unauthenticated remote attackers to execute arbitrary scripts in users' browsers when they interact with the UI. This could affect the confidentiality, integrity, and availability of the application and potentially impact connected systems when supported by the advisory's specified conditions.

UI settings and user session data.
Via crafted UI updates visible to other users.
Compromise of user sessions and application control.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in SUSE Rancher's UI requires immediate attention from teams managing Kubernetes infrastructure and the application itself. The first step is to inventory all instances of SUSE Rancher, determine their exposure and criticality, and identify the specific system owners. Based on this assessment, a remediation plan can be developed, potentially involving coordination with the vendor and scheduling maintenance.

Identify SUSE Rancher instances and owners.
Verify external reachability and business criticality.
Plan targeted remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is SUSE Rancher and why do organizations use it?

SUSE Rancher is a comprehensive management platform designed for Kubernetes clusters. It provides a centralized interface that simplifies the deployment, operations, and monitoring of containerized applications across various environments, whether on-premises or in the cloud.

What does CWE-79 mean in the context of CVE-2026-88804?

CWE-79 refers to Improper Neutralization of Input During Web Page Generation, commonly known as Cross-Site Scripting (XSS). In this CVE, the vulnerability allows an attacker to inject malicious scripts into the Rancher UI. When other users view the compromised settings, their browsers execute the script, potentially leading to unauthorized actions or data theft.

How can an attacker trigger this Rancher UI vulnerability?

An attacker triggers this by sending crafted requests to the Rancher UI that update public settings. Because the vulnerability allows unauthenticated access to modify these specific settings, the attacker does not need to be a logged-in user. Simply reading legitimate UI settings or navigating the interface without attempting to modify them does not trigger the bug.

Is my instance of Rancher at risk according to Halo Surface Signal?

Halo Surface Signal notes that Rancher is often deployed as an internet-facing administrative portal to enable remote management. If your instance is accessible from the public internet, it faces a higher likelihood of risk. Internal-only instances generally have a smaller surface area, but administrators should still verify their specific network accessibility.

What should I do first to address CVE-2026-88804?

Begin by conducting an inventory of all your SUSE Rancher instances to identify which versions are in use. Cross-reference these versions against the affected list (such as 2.15 before 2.15.2, 2.14 before 2.14.6, etc.) to confirm if you are running vulnerable software. Once identified, evaluate the network exposure of these instances to prioritize patching for those accessible to unauthorized users.

References

github.com/rancher/rancher/security/advisories/GHSA-992f-xh8r-jg2f

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.