CVE-2026-88804NVD

Vulnerability Summary

rancher/rancher repository advisory GHSA-992f-xh8r-jg2f

Severity Level

CRITICAL(9.4)

Published Date

Sep 23, 2026

Last Modified

Sep 23, 2026

Exploitation Status

No confirmed exploitation yet

CVE Record Status

Reserved

This CVE ID is referenced in a public advisory, but the CVE Program has not published its official CVE Record yet. Full CVSS/CPE data from NVD will appear here once it does.

EPSS Score (30-Day)

Data Pending

Root Weakness (CWE)

CWE-79: Cross-site Scripting (XSS) ↗

The software does not neutralize user-controllable input before it is placed in output that is used as a web page.

CWE-862: Missing Authorization ↗

The software does not perform an authorization check when an actor attempts to access a resource or perform an action.

CVSS v4.0 Base Metrics — Score 9.4

Attack VectorNetwork

Attack ComplexityLow

Attack RequirementsNone

Privileges RequiredNone

User InteractionPassive

Confidentiality (Vulnerable System)High

Integrity (Vulnerable System)High

Availability (Vulnerable System)High

Confidentiality (Subsequent System)High

Integrity (Subsequent System)High

Availability (Subsequent System)High

Affected & Patched Versions

Affected Versions

github.com/rancher/rancher >=v2.15.0, <v2.15.2
github.com/rancher/rancher >=v2.14.0, <v2.14.6
github.com/rancher/rancher >=v2.13.0, <v2.13.10
github.com/rancher/rancher >=v2.12.0, <v2.12.14
github.com/rancher/rancher >=v2.11.0, <v2.11.18

Patched Versions

github.com/rancher/rancher v2.15.2
github.com/rancher/rancher v2.14.6
github.com/rancher/rancher v2.13.10
github.com/rancher/rancher v2.12.14
github.com/rancher/rancher v2.11.18

📧Email Delivery — Threat intel straight to your inbox.

♾️Unlimited Vendors — Track your entire stack.

🚨All New CVEs — Be the first to know.

⚙️Custom EPSS — Filter noise, focus on risk.

💬Webhooks — Slack & Teams integration.

🚫Ad-Free — Uninterrupted experience.