CVE-2026-88804: Critical Unauthenticated XSS in Rancher

CVE-2026-88804 affects SUSE Rancher: according to the official NVD description, an unauthenticated update of public UI settings allows a remote attacker to execute a stored cross-site scripting attack in the management interface. The specific product is not reported in the data beyond Rancher itself.

The vulnerability has a CVSS score of 9.6, placing it in the critical range, and was published on NVD on September 28, 2026. A signal was observed regarding a public GitHub repository that claims to contain a proof-of-concept for this CVE, dated October 29, 2026: this indicates attention from the technical community toward the flaw, but does not confirm active exploitation in real-world environments. No other social signals are present in the data.

For defenders managing Kubernetes clusters through Rancher, the priority is applying updates to the corrected versions indicated by the vendor: 2.15.2, 2.14.6, 2.13.10, 2.12.14, or 2.11.18, depending on the respective release line. An unauthenticated XSS vulnerability in the management UI of a Kubernetes infrastructure can have a significant impact, since the UI is often used by operators with broad privileges.

While updating or in addition to it, teams should review Rancher console access logs, limit exposure of the public UI to unnecessary networks, and monitor for anomalous activity linked to manipulation of the interface's public settings.