high · CVSS v3 7.6

CVE-2026-88809

The vulnerability in SUSE Rancher Manager’s /meta/proxy endpoint allows requests to bypass the allowlist and be forwarded to arbitrary desti

Overview

The vulnerability in SUSE Rancher Manager’s /meta/proxy endpoint allows requests to bypass the allowlist and be forwarded to arbitrary destinations. It affects Rancher versions 2.11.0–2.15.3 and older EOL releases. Attackers could use this to exfiltrate data or pivot to internal services.

Description

A security vulnerability exists in the SUSE Rancher Manager meta proxy endpoint (/meta/proxy). This endpoint is intended to forward requests only to destinations that appear on a configured allowlist. The allowlist decision was evaluated in a place where it could not stop a request from being forwarded, so a rejected destination was logged but the request was still handed to the proxy's transport. This affects SUSE Rancher 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, 2.13.0 up to 2.13.11, 2.12.0 up to 2.12.15, 2.11.0 up to 2.11.19 and potentially older EOL versions.

Impact

Confidentiality: unauthorized data exposure via proxy. Integrity: potential manipulation of forwarded traffic. Availability: minimal direct impact but could enable lateral movement. Defenders: Rancher administrators and network security teams.

Remediation

Apply the latest Rancher Manager patch that fixes the allowlist evaluation bug. If a patch is unavailable, restrict /meta/proxy access to trusted IPs via firewall or reverse proxy and monitor proxy logs for unexpected destinations. Verify that the allowlist is correctly configured and validated before deployment.

Risk context

Severity high (CVSS 7.6). No EPSS data available. Urgent patching is recommended for all affected Rancher deployments.

Affected products

  • SUSE Rancher 2.15.x
  • SUSE Rancher 2.14.x
  • SUSE Rancher 2.13.x
  • SUSE Rancher 2.12.x
  • SUSE Rancher 2.11.x
  • SUSE Rancher EOL

Scores

Severity
high
CVSS v2
6.8
CVSS v3
7.6
CVSS v4
—
EPSS
—

rancher proxy allowlist high-severity confidentiality network-attack patch-needed

← All CVEs

Related CVEs

high

CVE-2026-119301

Improper neutralization of quoting syntax in SQL identifier construction in the Apache Iceberg write component in AWS SDK for pandas (also published as awswrangler) 3.5.2 through 3.17.0 might allow an authenticated remote user with permission to modify AWS Glue Data Catalog metadata to read any table that a separate, more privileged principal can access and write to the table that principal is updating via a crafted column name. To remediate this issue, users should upgrade to version 3.17.1 or later.

View analysis

high

CVE-2026-120830

A flaw was found in libslirp in icmp_forward_error(). When building an ICMP error response, the length of the quoted original IPv4 packet was taken from the IP header without clamping it to the actual buffer length. A truncated or malformed packet could cause an out-of-bounds heap read, leaking host memory into the ICMP error packet returned to a guest or container.

View analysis

high

CVE-2026-120833

Labbench versions prior to 0.46.1 deserialize untrusted .p or .pickle files using pandas.read_pickle, enabling arbitrary code execution when a user loads such files. The flaw allows attackers to run malicious code on the host system. It is a high‑severity vulnerability that can compromise confidentiality, integrity, and availability of affected installations.

View analysis

high

CVE-2026-107441

An out-of-bounds write vulnerability in the CGI program of Zyxel GS1900-24E firmware versions through 2.90(AAHK.2)C0 could allow an unauthenticated adjacent attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.

View analysis