CVE-2026-88810

A privilege escalation issue was discovered in Rancher Manager's role-based access control. The inheritedNamespacedRules field of a GlobalRole propagates permissions into named namespaces of every downstream cluster managed by the Rancher instance, but it was not subject to the privilege-escalation validation applied to the other permission-carrying fields of a GlobalRole. As a result, a non-administrative user could be granted, through a global role binding, permissions in downstream clusters that exceed the permissions that user already holds. This affected SUSE Rancher 2.15.2 only, and SUSE Rancher Webhook 0.11.0 up to 0.11.4, and 0.12.0 up to 0.12.1.

CVSS v3 7.2 HIGH

7.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/rancher/webhook/security/advisories/GHSA-f898-2c8h-r7jc

Configurations

No configuration.

History

02 Nov 2026, 17:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-11-02 17:17

Updated : 2026-11-03 05:18

NVD link : CVE-2026-88810

Mitre link : CVE-2026-88810

CVE.ORG link : CVE-2026-88810

JSON object : View

Products Affected

No product.

CWE

CWE-306

Missing Authentication for Critical Function

{"id": "CVE-2026-88810", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-88810", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-11-02T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "meissner@suse.de", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "affected": [{"source": "meissner@suse.de", "affectedData": [{"repo": "https://github.com/rancher/rancher/", "vendor": "SUSE", "product": "Rancher", "versions": [{"status": "affected", "version": "2.15.2", "lessThan": "2.15.3", "versionType": "semver"}], "packageName": "Rancher", "defaultStatus": "unaffected"}, {"repo": "https://github.com/rancher/webhook/", "vendor": "SUSE", "product": "Rancher", "versions": [{"status": "affected", "version": "0.11.0", "lessThan": "0.11.4", "versionType": "semver"}, {"status": "affected", "version": "0.12.0", "lessThan": "0.12.1", "versionType": "semver"}], "packageName": "Webhook", "defaultStatus": "unaffected"}]}], "published": "2026-11-02T17:17:45.647", "references": [{"url": "https://github.com/rancher/webhook/security/advisories/GHSA-f898-2c8h-r7jc", "source": "meissner@suse.de"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "meissner@suse.de", "description": [{"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "A privilege escalation issue was discovered in Rancher Manager's role-based access control. The inheritedNamespacedRules field of a GlobalRole propagates permissions into named namespaces of every downstream cluster managed by the Rancher instance, but it was not subject to the privilege-escalation validation applied to the other permission-carrying\u00a0fields of a GlobalRole.\u00a0As a result, a non-administrative user could be granted, through a global role\u00a0 binding,\u00a0permissions in downstream clusters that exceed the permissions that user already holds. This affected SUSE Rancher 2.15.2 only, and SUSE Rancher Webhook 0.11.0 up to 0.11.4, and 0.12.0 up to 0.12.1."}], "lastModified": "2026-11-03T05:18:53.200", "sourceIdentifier": "meissner@suse.de"}