CVE-2026-88804 — Unauthenticated update of public UI settings leading to stored cross-site scripting in Rancher

CVE-2026-88804

Unauthenticated update of public UI settings leading to stored cross-site scripting in Rancher PUBLISHED

Description (CNA)

An unauthenticated update of public UI settings could be used by remote attackers to execute a stored cross-site scripting attack in the Rancher UI, in SUSE Rancher 2.15 before 2.15.2, 2.14 before 2.14.6, 2.13 before 2.13.10, 2.12 before 2.12.14 and 2.11 before 2.11.18.

Affected (CNA)

Vendor / product	Versions
SUSE / Rancher	affected 2.15.0 before 2.15.2; affected 2.14.0 before 2.14.6; affected 2.13.0 before 2.13.10; affected 2.12.0 before 2.12.14; affected 2.11.0se before 2.11.18

CWE

CWE-79

References

https://github.com/rancher/rancher/security/advisories/GHSA-992f-xh8r-jg2f

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.