CVE-2026-88808

A vulnerability has been identified within Rancher Manager where the Fleet agent wrote resources to downstream clusters using its own cluster-admin credentials instead of the ServiceAccount pinned to the deployment. It affects multi-tenancy environments where different tenants share the same downstream clusters, for example different privileged or untrusted teams inside the same organization. This could lead to overwritten configuration files. This issue affected SUSE Rancher Fleet 0.16 before 0.16.2, 0.15 before 0.15.7, and 0.14 before 0.14.11.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/rancher/fleet/security/advisories/GHSA-q9v4-358v-r8q5	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:suse:rancher_fleet::::::::
	cpe:2.3:a:suse:rancher_fleet::::::::
	cpe:2.3:a:suse:rancher_fleet::::::::

History

07 Oct 2026, 17:00

Type	Values Removed	Values Added
First Time		Suse Suse rancher Fleet
CPE		cpe:2.3:a:suse:rancher_fleet::::::::
References	~~() https://github.com/rancher/fleet/security/advisories/GHSA-q9v4-358v-r8q5 -~~	() https://github.com/rancher/fleet/security/advisories/GHSA-q9v4-358v-r8q5 - Vendor Advisory

28 Sep 2026, 16:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-28 16:17

Updated : 2026-10-07 17:00

NVD link : CVE-2026-88808

Mitre link : CVE-2026-88808

CVE.ORG link : CVE-2026-88808

JSON object : View

Products Affected

suse

rancher_fleet

CWE

CWE-250

Execution with Unnecessary Privileges

{"id": "CVE-2026-88808", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-88808", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-09-28T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "meissner@suse.de", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "meissner@suse.de", "affectedData": [{"repo": "https://github.com/rancher/fleet/", "vendor": "SUSE", "product": "Rancher", "versions": [{"status": "affected", "version": "0.16.0", "lessThan": "0.16.2", "versionType": "semver"}, {"status": "affected", "version": "0.15.0", "lessThan": "0.15.7", "versionType": "semver"}, {"status": "affected", "version": "0.14.0", "lessThan": "0.14.11", "versionType": "semver"}], "packageName": "Fleet", "defaultStatus": "unaffected"}]}], "published": "2026-09-28T16:17:16.150", "references": [{"url": "https://github.com/rancher/fleet/security/advisories/GHSA-q9v4-358v-r8q5", "tags": ["Vendor Advisory"], "source": "meissner@suse.de"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "meissner@suse.de", "description": [{"lang": "en", "value": "CWE-250"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified within Rancher Manager where the Fleet agent wrote resources to downstream clusters using its own cluster-admin credentials instead of the ServiceAccount pinned to the deployment. It affects multi-tenancy environments where different tenants share the same downstream clusters, for example different privileged or untrusted teams inside the same organization. This could lead to overwritten configuration files.\n\nThis issue affected SUSE Rancher Fleet 0.16 before 0.16.2, 0.15 before 0.15.7, and 0.14 before 0.14.11."}], "lastModified": "2026-10-07T17:00:32.977", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:suse:rancher_fleet:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C5143457-F2CD-4F48-BAD8-13A33A262112", "versionEndExcluding": "0.14.11", "versionStartIncluding": "0.14.0"}, {"criteria": "cpe:2.3:a:suse:rancher_fleet:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7207500A-074F-4806-B754-12208EA6E30F", "versionEndExcluding": "0.15.7", "versionStartIncluding": "0.15.0"}, {"criteria": "cpe:2.3:a:suse:rancher_fleet:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CB9E92F7-C809-408F-9689-943D5B0BF626", "versionEndExcluding": "0.16.2", "versionStartIncluding": "0.16.0"}], "operator": "OR"}]}], "sourceIdentifier": "meissner@suse.de"}