EUVD-2026-88339Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Agree with vendor: network-reachable token reuse (AV:N/AC:L), PR:N since the attacker reuses a stale token rather than authenticating with own current creds, UI:R because a victim logout is required, C:H/I:H from full account/cluster access, A:N.
Primary rating from Vendor (suse).
CVSS VectorVendor: suse
Lifecycle Timeline
6DescriptionCVE.org
Incorrect credential cleaning on logout could be used by remote attackers to keep access credentials even after the account was logged out. Affected is SUSE Rancher 2.15 before 2.15.2.
Articles & Coverage 1
AnalysisAI
Remote attackers holding a previously issued Rancher session token can retain access even after the legitimate user logs out in SUSE Rancher 2.15 before 2.15.2, because the server fails to clear credentials on logout (CWE-613). This session persistence flaw carries a CVSS 3.1 base score of 8.1 (High) with network reach, low complexity, no attacker privileges (PR:N), and required user interaction (UI:R) for the logout. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to already possess a valid Rancher session credential/token that was issued before the victim's logout, and requires the legitimate user to perform a logout (UI:R) which the attacker expects to have no effect due to improper server-side credential cleaning. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) yields a base score of 8.1 (High), driven by network reach, low complexity, no attacker privileges, and high confidentiality plus integrity impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to SUSE Rancher 2.15.2 or later. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Rancher deployments to confirm which run 2.15 below 2.15.2, treat every session token and API key issued to those instances as potentially reusable after logout, and centrally revoke and reissue all active Rancher session and API tokens; simultaneously confirm audit logging is enabled and restrict the Rancher management interface to trusted networks or VPN. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Kubernetes
View allA critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.exter
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Rated critical severity (CVSS 9.9), this vulne
Unauthenticated remote attackers can trigger complete database overwrites, server-side file reads, and SSRF attacks agai
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
Fluentd configuration injection in the kube-logging Logging operator before 6.6.0 allows a namespace-scoped user who can
Kyverno Kubernetes policy engine prior to 1.x has a privilege escalation vulnerability (CVSS 9.9) allowing policy bypass
Same weakness CWE-613 – Insufficient Session Expiration
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: ImportantShare
External POC / Exploit Code
Leaving vuln.today