CVE-2026-88808

Last refreshed2026-10-12

Status: UPDATED | Advisory ID: CVE-2026-88808

Key Details

CVE	CVE-2026-88808
CVSS Score / Version	8.8 (High) / CVSS v3.1
Updated	2026-10-07
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
CVSS Prose	attack vector is network; attack complexity is low; privileges required is low; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products	suse Rancher and suse rancher_fleet
Classified as	CWE-250 (Execution with Unnecessary Privileges)

Affected Products, Subsystems & Sectors

Vendor	Product	Affected Versions	Patch Status
suse	Rancher
suse	rancher_fleet

Vendor

Product

Affected Versions

Patch Status

suse

Rancher

suse

rancher_fleet

Subsystems	General OT
Sectors	Multiple

What to Know

A vulnerability has been identified within Rancher Manager where the Fleet agent wrote resources to downstream clusters using its own cluster-admin credentials instead of the ServiceAccount pinned to the deployment. It affects multi-tenancy environments where different tenants share the same downstream clusters, for example different privileged or untrusted teams inside the same organization. This could lead to overwritten configuration files.

This issue affected SUSE Rancher Fleet 0.16 before 0.16.2, 0.15 before 0.15.7, and 0.14 before 0.14.11. (NVD)

What to Do

Monitor suse's web page for any future patch releases. See vendor advisory link below.

References

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-88808
CVE	https://www.cve.org/CVERecord?id=CVE-2026-88808
Vendor advisory	https://github.com/rancher/fleet/security/advisories/GHSA-q9v4-358v-r8q5

Source

Reference

NVD

https://nvd.nist.gov/vuln/detail/CVE-2026-88808

CVE

https://www.cve.org/CVERecord?id=CVE-2026-88808

Vendor advisory