Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| SUSE | Rancher | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Mon, 02 Nov 2026 16:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A security vulnerability exists in the SUSE Rancher Manager meta proxy endpoint (/meta/proxy). This endpoint is intended to forward requests only to destinations that appear on a configured allowlist. The allowlist decision was evaluated in a place where it could not stop a request from being forwarded, so a rejected destination was logged but the request was still handed to the proxy's transport. This affects SUSE Rancher 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, 2.13.0 up to 2.13.11, 2.12.0 up to 2.12.15, 2.11.0 up to 2.11.19 and potentially older EOL versions. | |
| Title | Rancher meta proxy allowlist bypass leading to server-side request forgery | |
| First Time appeared |
Suse
Suse rancher |
|
| Weaknesses | CWE-918 | |
| CPEs | cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Suse
Suse rancher |
|
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: suse
Published:
Updated: 2026-11-02T16:03:20.465Z
Reserved: 2026-09-10T08:35:07.010Z
Link: CVE-2026-88809
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-11-02T16:17:44.897
Modified: 2026-11-02T16:17:44.897
Link: CVE-2026-88809
Redhat
No data.
OpenCVE Enrichment
No data.
-
CWE-918
Server-Side Request Forgery (SSRF)