Rancher
Security incidents tagged Rancher. Newest first.
1 Rancher incident in the last 12 months
- Incidents
- 1
- Live
- 1
- Patched
- 1
- Days without an incident
- 1
- Longest quiet run: 1 day (Oct 30–Oct 30)
- Patched
Rancher and Fleet October 2026 security release: any Rancher user could become cluster-admin on the management cluster (CVE-2026-94290)
SUSE shipped Rancher Manager v2.15.3, v2.14.7, v2.13.11, v2.12.15 and v2.11.19 with Fleet v0.16.3, v0.15.8, v0.14.12 and v0.13.17 on Oct 29 2026, fixing six vulnerabilities. The worst is CVE-2026-94290 (CVSS 4.0 9.4 critical) in Fleet's agent management controller, which runs on the Rancher local cluster as cluster-admin: it did not restrict which kubeconfig secrets a Fleet Cluster object could reference, so an authenticated Rancher user with only the default user global role could get full cluster-admin on the management cluster, exposing every secret there, including credentials for all downstream clusters. Fleet is enabled by default in Rancher. The release also fixes CVE-2026-104615 (high), a Fleet cluster identity takeover where a holder of a workspace registration token could claim another cluster's identity and read Secrets and ConfigMaps synced into its Fleet namespace; CVE-2026-104623 (medium), where any authenticated user could get an unprivileged shell pod on the management cluster; CVE-2026-88809 (high), a meta proxy allowlist bypass leading to server-side request forgery; CVE-2026-88811 (high), where the meta proxy leaked the caller's Rancher credentials to third-party cloud provider hosts; and CVE-2026-88810, a GlobalRole RBAC escalation fixed in v2.15.3.
SUSE Rancher Manager and Rancher FleetSince Oct 29, 2026
