{"affected":[{"defaultStatus":"unaffected","packageName":"Rancher","product":"Rancher","source":"CNA: suse","vendor":"SUSE","versions":[{"lessThan":"2.15.3","status":"affected","version":"2.15.0","versionType":"semver"},{"lessThan":"2.14.7","status":"affected","version":"2.14.0","versionType":"semver"},{"lessThan":"2.13.11","status":"affected","version":"2.13.0","versionType":"semver"},{"lessThan":"2.12.15","status":"affected","version":"2.12.0","versionType":"semver"},{"lessThan":"2.11.19","status":"affected","version":"2.11.0","versionType":"semver"}]},{"ecosystem":"go","packageName":"github.com/rancher/rancher","product":"github.com/rancher/rancher","source":"GitHub GHSA-x82x-2qj6-5rm2","vendor":"","versions":[{"status":"affected","version":">=2.15.0, <2.15.3","versionType":"GitHub advisory range"}]},{"ecosystem":"go","packageName":"github.com/rancher/rancher","product":"github.com/rancher/rancher","source":"GitHub GHSA-x82x-2qj6-5rm2","vendor":"","versions":[{"status":"affected","version":">=2.14.0, <2.14.7","versionType":"GitHub advisory range"}]},{"ecosystem":"go","packageName":"github.com/rancher/rancher","product":"github.com/rancher/rancher","source":"GitHub GHSA-x82x-2qj6-5rm2","vendor":"","versions":[{"status":"affected","version":">=2.13.0, <2.13.11","versionType":"GitHub advisory range"}]},{"ecosystem":"go","packageName":"github.com/rancher/rancher","product":"github.com/rancher/rancher","source":"GitHub GHSA-x82x-2qj6-5rm2","vendor":"","versions":[{"status":"affected","version":">=2.12.0, <2.12.15","versionType":"GitHub advisory range"}]},{"ecosystem":"go","packageName":"github.com/rancher/rancher","product":"github.com/rancher/rancher","source":"GitHub GHSA-x82x-2qj6-5rm2","vendor":"","versions":[{"status":"affected","version":">=2.11.0, <2.11.19","versionType":"GitHub advisory range"}]}],"cveId":"CVE-2026-88811","cwes":["CWE-201"],"description":"Missing filtering in the SUSE Rancher Manager meta proxy could cause passed in rancher credentials to be leaked to cloud providers. This affects SUSE Rancher 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, 2.13.0 up to 2.13.11,","epss":null,"exploits":[],"kev":null,"metrics":[{"score":9.1,"severity":"critical","source":"CNA: suse","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},{"score":9.1,"severity":"critical","source":"NVD: meissner@suse.de","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"}],"modifiedAt":1793683133400,"publishedAt":1793638124799,"references":[{"source":"CNA: suse","tags":["vendor-advisory"],"url":"https://github.com/rancher/rancher/security/advisories/GHSA-x82x-2qj6-5rm2"},{"source":"meissner@suse.de","tags":[],"url":"https://github.com/rancher/rancher/security/advisories/GHSA-x82x-2qj6-5rm2"},{"source":"GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/rancher/rancher/security/advisories/GHSA-x82x-2qj6-5rm2"}],"remediation":[{"kind":"fix","source":"GitHub GHSA-x82x-2qj6-5rm2","text":"github.com/rancher/rancher (go): GitHub reports patched versions 2.15.3. Check the advisory for the affected release branch.","url":"https://github.com/rancher/rancher/security/advisories/GHSA-x82x-2qj6-5rm2"},{"kind":"fix","source":"GitHub GHSA-x82x-2qj6-5rm2","text":"github.com/rancher/rancher (go): GitHub reports patched versions 2.14.7. Check the advisory for the affected release branch.","url":"https://github.com/rancher/rancher/security/advisories/GHSA-x82x-2qj6-5rm2"},{"kind":"fix","source":"GitHub GHSA-x82x-2qj6-5rm2","text":"github.com/rancher/rancher (go): GitHub reports patched versions 2.13.11. Check the advisory for the affected release branch.","url":"https://github.com/rancher/rancher/security/advisories/GHSA-x82x-2qj6-5rm2"},{"kind":"fix","source":"GitHub GHSA-x82x-2qj6-5rm2","text":"github.com/rancher/rancher (go): GitHub reports patched versions 2.12.15. Check the advisory for the affected release branch.","url":"https://github.com/rancher/rancher/security/advisories/GHSA-x82x-2qj6-5rm2"},{"kind":"fix","source":"GitHub GHSA-x82x-2qj6-5rm2","text":"github.com/rancher/rancher (go): GitHub reports patched versions 2.11.19. Check the advisory for the affected release branch.","url":"https://github.com/rancher/rancher/security/advisories/GHSA-x82x-2qj6-5rm2"}],"revision":"2ba700a34aa648972c5b01b567029a054f23559ed607429d1d00446c1fd01ff9","sources":[{"modifiedAt":1793681753397,"name":"CNA: suse","retrievedAt":1793682645659,"url":"https://www.cve.org/CVERecord?id=CVE-2026-88811"},{"modifiedAt":1793683133400,"name":"NVD","retrievedAt":1793686562022,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88811"},{"modifiedAt":1793294802000,"name":"GitHub Security Advisories","retrievedAt":1793646009642,"url":"https://github.com/rancher/rancher/security/advisories/GHSA-x82x-2qj6-5rm2"}],"ssvc":{"assessedAt":1793577600000,"automatable":"yes","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"Rancher credentials disclosed to third-party hosts by the Rancher Manager meta proxy","updatedAt":1793686562022}