SUSE Rancher CVE-2026-88810

Requires an authenticated Rancher user who has already been delegated 'create' or 'update' on management.cattle.io globalroles AND 'create' on globalrolebindings; users without those delegated permissions are unaffected, and administrators (who normally hold them) gain no escalation. The deployment must run an affected Rancher 2.15.x line where the GlobalRole inheritedNamespacedRules field exists (2.14.x and earlier lack the field and are not affected). Limiting factors: the high delegated-privilege prerequisite sharply narrows the attacker population, and there is no workaround that fully addresses the issue - exposure is only reduced by restricting who can manage globalroles/globalrolebindings and by auditing existing GlobalRole/GlobalRoleBinding objects; upgrading is the only complete fix.

The CVSS 3.1 base score is 7.2 (High) with vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, meaning network-reachable and low-complexity but gated behind high privileges (PR:H). This gating is the decisive signal: the vendor advisory confirms exploitation requires an already-authenticated Rancher user who has been delegated the ability to create or update management.cattle.io globalroles and to create globalrolebindings - permissions normally held only by administrators, for whom this is not an escalation at all. No CISA KEV listing is present, so exploitation status is 'no public exploit identified at time of analysis'; no EPSS score was supplied, and no SSVC exploitation/automatable/technical-impact fields were provided beyond the vuln.today priority label 'this_week'. The combination (High CVSS driven by full C/I/A impact, but PR:H and a narrow delegated-permission precondition) places this as a real-but-conditional privilege-escalation issue rather than a mass-exploitable emergency: impactful where an organization has delegated partial RBAC-management rights to non-admins, low real risk in deployments that keep globalrole/globalrolebinding management restricted to administrators. One data conflict must be flagged: the NVD-style description states this 'affected SUSE Rancher 2.15.2 only,' while the GHSA advisory states 'Rancher v2.15.0 and later are affected' (with 2.14.x and earlier not affected because the inheritedNamespacedRules field does not exist there) - verify the exact affected 2.15.x range with SUSE. The CWE also differs across sources (input CWE-306 vs GHSA CWE-269/CWE-863); the privilege-management/authorization framing (269/863) better matches the described missing privilege-escalation validation than missing authentication (306).

An organization delegates limited RBAC management to a non-administrative user, granting them the ability to create/update GlobalRoles and create GlobalRoleBindings. That user authors a GlobalRole whose inheritedNamespacedRules field declares permissions exceeding their own, then binds it to themselves via a GlobalRoleBinding; because that field escaped the privilege-escalation validation applied to other GlobalRole fields, the excess permissions propagate into named namespaces across every downstream cluster. No public exploit code was identified at time of analysis, and exploitation is bounded by the required delegated permissions.