CVE-2026-88808
High
Description
A vulnerability has been identified within Rancher Manager where the Fleet agent wrote resources to downstream clusters using its own cluster-admin credentials instead of the ServiceAccount pinned to the deployment. It affects multi-tenancy environments where different tenants share the same downstream clusters, for example different privileged or untrusted teams inside the same organization. This could lead to overwritten configuration files. This issue affected SUSE Rancher Fleet 0.16 before 0.16.2, 0.15 before 0.15.7, and 0.14 before 0.14.11.
SeverityHigh
CVSS8.8
Exploit probability—
Product
Suse Rancher Fleet
PublishedSep 28, 2026
First seenSep 28, 2026
Weakness typeCWE-250CWE-250
How to fix
Update
- suse rancher_fleet0.14.11, 0.15.7, 0.16.2 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| suse rancher_fleet | 0.14.0 ≤ v < 0.14.11, 0.15.0 ≤ v < 0.15.7, 0.16.0 ≤ v < 0.16.2 | 0.14.11, 0.15.7, 0.16.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.