CVE-2026-88804

An Improper Privilege Management vulnerability in SUSE Rancher allowed standard users to leverage existing permissions to manipulate Kubernetes secrets in the local cluster, resulting in the secret being deleted while read-level permissions were preserved. Followed by specially crafted commands, this could let a user gain access to tokens belonging to service accounts in the local cluster. Affects Rancher >= 2.6.0 < 2.6.13 and >= 2.7.0 < 2.7.4.

In SUSE Rancher 2.15 before 2.15.2, incorrect credential cleaning on logout could be used by remote attackers to keep access credentials even after the account was logged out, potentially leading to unauthorized access.

An Improper Privilege Management vulnerability in SUSE Rancher causes permission changes in Azure AD not to be reflected to users while logged into the Rancher UI. Users retain previous permissions even if their Azure AD group changes or they are removed from a group. Affects Rancher >= 2.6.7 < 2.6.13 and >= 2.7.0 < 2.7.4.

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SUSE Rancher allows users in some higher-privileged groups to inject code that is executed within another user's browser, enabling theft of sensitive information, content manipulation, or other malicious activities on behalf of victims. This could let a user with write access to affected areas act on behalf of an administrator once the administrator opens the affected web page. The issue affects Rancher from >= 2.6.0 before < 2.6.13 and from >= 2.7.0 before < 2.7.4.