SUSE Rancher CVE-2026-88809

The attacker must be an authenticated Rancher user (no administrative privileges on the local cluster required). The request must reach Rancher as an HTTP/1.1 request carrying the full destination URL in the request line, with no HTTP-aware proxy in between to rewrite it - HTTP/2 cannot carry this form. This is the decisive limiter: the default Helm Ingress with nginx, Traefik, Envoy, or HAProxy rewrites or rejects such requests, blocking that path; however, several supported configurations leave it open - direct access to the Rancher Service from a pod in the local cluster (possible on EVERY installation), networkExposure.type: none with a layer-4 load balancer, TLS passthrough via tls: external, and hostPort/hostNetwork exposure. Credential-theft impact additionally requires the reachable target to answer, e.g. AWS IMDSv1 being enabled. Per the vendor, upgrading is the only complete fix; an ingress controller narrows reach but must not be relied on as a mitigating control.

This is a server-side request forgery flaw (CWE-918/CWE-636) in the Rancher Manager /meta/proxy allowlist, rated CVSS 7.6 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N) with a vuln.today decision label of this_week. There is a notable signal conflict: the published CVSS encodes PR:H (high privileges), but the vendor advisory states explicitly that the attacker need only be an authenticated Rancher user with NO administrative privileges on the local cluster - this points to PR:L, meaning the vector arguably understates reach while the 7.6 base may slightly misattribute the privilege requirement. No EPSS score, no CISA KEV listing, and no confirmed public exploit were supplied, so there is no evidence of active exploitation; the only reference is the vendor GHSA advisory, not proof-of-concept code. Real-world risk is genuinely elevated rather than inflated-CVSS noise: the scope-change (S:C) and C:H are well-justified because the Rancher server sits in a privileged network position and can be coerced into reaching internal services and, where AWS IMDSv1 is enabled, the cloud instance metadata endpoint - a realistic path to cloud credential theft. The principal risk moderator is the documented delivery precondition (see exploitation_conditions), which blocks exploitation through a standard HTTP-aware ingress but not from pods inside the local cluster. Net assessment: a credible priority for Rancher operators, consistent with the this_week label, driven by exploitability-by-any-authenticated-user and high internal-disclosure impact, even absent exploitation evidence.

An authenticated non-admin Rancher user (or an attacker controlling a pod in the local cluster) sends a request to /meta/proxy naming an internal destination that the allowlist is supposed to block; because the allowlist decision is only logged and not enforced, the Rancher server forwards the request and returns the response. The attacker queries the cloud instance metadata endpoint (e.g. AWS IMDSv1) to exfiltrate cloud provider credentials or reaches other internal services unreachable from their own position. No public exploit code was identified at time of analysis; only the vendor advisory exists.