CVE WatchNov 2, 2026

CVE-2026-88811

Missing filtering in the SUSE Rancher Manager meta proxy could cause passed in rancher credentials to be leaked to cloud providers. This aff

CVSS

9.1

Critical

EPSS

—

KEV

—

Exploit Today

—

0-100

Published: Nov 2, 2026 · Last modified: Nov 2, 2026 · CWE-201

EPSS · 30d

Not enough EPSS history yet.

Technical description

Missing filtering in the SUSE Rancher Manager meta proxy could cause passed in rancher credentials to be leaked to cloud providers. This affects SUSE Rancher 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, 2.13.0 up to 2.13.11,

Official references

github.comhttps://github.com/rancher/rancher/security/advisories/GHSA-x82x-2qj6-5rm2

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-1168617.5 HIG

26.9%

——8Unauthenticated Sensitive Data Exposure in Flexible Chat <= 1.1.0 versions.3d CVE-2026-1159476.5 MED

12.4%

——4Unauthenticated Sensitive Data Exposure in HUSKY <= 1.4.6 versions.3d CVE-2026-1195645.3 MED

21.8%

——7Plausible Analytics Community Edition through 3.2.1 contains an information exposure vulnerability that allows site editors to obtain pending invitation and ownership-transfer IDs from the settings/people page. Attackers can register with the invitee's email using the exposed ID and accept it, gaining the invited role or taking site ownership.3d CVE-2026-1072684.3 MED

22.2%

——7Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Two Factor Authentication - TFA / Passwordless Login allows Forceful Browsing. This issue affects Two Factor Authentication - TFA / Passwordless Login versions: from 0.0.0 to 5.4.1, from 5.5.0 to 5.5.2.3d CVE-2026-450498.3 HIG

26.4%

——8Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the `Cross-Domain Single Sign-On` (`CDSSO`) servlet allows a logged-in user's raw OpenAM session token to be POSTed to an attacker-controlled URL. An attacker who induces an authenticated victim to visit a crafted URL can receive the session credential and potentially hijack the session. Deployments must have `CDSSO` enabled, as is common in multi-domain deployments, and exploitation is additionally gated on a non-default configuration being absent. This issue is fixed in version 16.1.1.3d CVE-2026-482005.3 MED

20.8%

——6Insertion of Sensitive Information Into Sent Data vulnerability in Barn2 Plugins Document Library Lite document-library-lite allows Retrieve Embedded Sensitive Data.This issue affects Document Library Lite: from n/a through 1.3.0.4d