CVE-2026-88804

Upstream information

CVE-2026-88804 at MITRE

Description

An unauthenticated update of public UI settings could be used by remote attackers to execute a stored cross-site scripting attack in the Rancher UI, in SUSE Rancher 2.15 before 2.15.2, 2.14 before 2.14.6, 2.13 before 2.13.10, 2.12 before 2.12.14 and 2.11 before 2.11.18.

---

Upstream Security Advisories:

• https://github.com/rancher/rancher/security/advisories/GHSA-992f-xh8r-jg2f

Other Security Trackers

• EUVD-2026-88340

SUSE information

Overall state of this security issue: Resolved

This issue is currently rated as having critical severity.

CVSS v3 Scores

CVSS detail	CNA (SUSE)
Base Score	9.6
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Attack Vector	Network
Attack Complexity	Low
Privileges Required	None
User Interaction	Required
Scope	Changed
Confidentiality Impact	High
Integrity Impact	High
Availability Impact	High
CVSSv3 Version	3.1

SUSE Bugzilla entry: 1280721 [RESOLVED / FIXED]

SUSE Security Advisories:

• GHSA-992f-xh8r-jg2f, published Thu Sep 24 01:02:30 CEST 2026

---

SUSE Timeline for this CVE

CVE page created: Thu Sep 24 12:06:49 2026
CVE page last modified: Tue Sep 29 18:44:51 2026