Ce mail provient de l'extérieur, restons vigilants

=====================================================================


                            CERT-Renater

                Note d'Information No. 2026/VULN1028
_____________________________________________________________________

DATE                : 15/10/2026

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running rancher (Go) versions prior to
                                         2.15.2.

====================================================================
https://github.com/rancher/rancher/security/advisories/GHSA-992f-xh8r-jg2f
https://github.com/rancher/rancher/security/advisories/GHSA-6vpq-mf48-9794
_____________________________________________________________________

Unauthenticated update of public UI settings leading to stored
cross-site scripting in Rancher

Critical	pdellamore published GHSA-992f-xh8r-jg2f 

Package
 github.com/rancher/rancher (Go)

Affected versions
>=v2.15.0, <v2.15.2
>=v2.14.0, <v2.14.6
>=v2.13.0, <v2.13.10
>=v2.12.0, <v2.12.14
>=v2.11.0, <v2.11.18

Patched versions
v2.15.2
v2.14.6
v2.13.10
v2.12.14
v2.11.18


Description

Impact
A security vulnerability exists in the Rancher Manager API routes that
serve a small set of public UI settings without authentication. These
routes were intended to be read-only, but a request-parsing behavior
in the underlying Norman API framework allowed a remote,
unauthenticated user with network access to the Rancher server to
modify the values of those public settings.

Because one of these settings is rendered as raw HTML on the Rancher
login page, an unauthenticated attacker could persist
attacker-controlled content that is then executed in the browser of
any user who opens the login page, in the Rancher origin. This can
lead to disclosure of the local administrator bootstrap password or
hijacking of an active administrator session, and therefore to full
administrative control of the Rancher installation and of the
downstream clusters it manages.

Preconditions
The attacker requires network access to the Rancher server endpoint.
No Rancher account, credentials, or prior privileges are required.
A legitimate user must subsequently open the Rancher login page for
the stored content to take effect. No other deliberate action from
that user is required.

Note

Deployments in a default configuration are affected; no non-default
feature or setting needs to be enabled.

Patches
The fix hardens the unauthenticated Rancher API router so that the
public settings endpoints are strictly read-only. Request parameters
that could reinterpret the effective HTTP method of a request are
now stripped before the request reaches the management API handler,
so requests to these unauthenticated routes can no longer result in
a write to a setting.

The change is server-side only and does not alter the values or
behavior of the settings themselves, so no user action beyond
upgrading is required.

Patched versions of Rancher include releases v2.15.2, v2.14.6,
v2.13.10, v2.12.14, and v2.11.18.

Administrators who suspect their installation was targeted before
upgrading should review the current values of the public UI settings
(for example ui-pl, first-login, ui-banners, ui-brand, ui-issues,
and ui-default-landing) and restore any unexpected values, rotate
the local administrator password, and invalidate existing
administrator tokens and sessions.

Workarounds
No workaround fully addresses the issue other than upgrading to a
patched version. Users who cannot upgrade immediately can reduce
exposure by:

Restricting network access to the Rancher server endpoint to
trusted networks and clients.

Placing Rancher behind a reverse proxy, WAF, or ingress policy
that rejects requests to the unauthenticated /v3/settings/*
endpoints carrying HTTP method-override parameters or request
bodies, allowing only plain read requests.

Monitoring the values of the public UI settings listed above
for unexpected changes.


Credits
This vulnerability was originally discovered and reported by
@StopWar.

For more information
If you have any questions or comments about this advisory:

Reach out to the SUSE Rancher Security team for security related
inquiries.


Open an issue in the Rancher repository.
Verify our support matrix and product support life cycle.


Severity
Critical
9.4/ 10

CVSS v4 base metrics
Exploitability Metrics
Attack Vector
Network
Attack Complexity
Low
Attack Requirements
None
Privileges Required
None
User interaction
Passive
Vulnerable System Impact Metrics
Confidentiality
High
Integrity
High
Availability
High
Subsequent System Impact Metrics
Confidentiality
High
Integrity
High
Availability
High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

CVE ID
CVE-2026-88804

Weaknesses
WeaknessCWE-79
WeaknessCWE-862

Credits
@PatrikFehrenbach PatrikFehrenbach

Reporter
@kevin-mizu kevin-mizu
Reporter

_____________________________________________________________________

Session Not Revoked Server-Side on Logout in Rancher
High	pdellamore published GHSA-6vpq-mf48-9794

Package
 github.com/rancher/rancher (Go)

Affected versions
>=v2.15.0, <v2.15.2

Patched versions
v2.15.2


Description

Impact

A session revocation vulnerability exists in Rancher's logout handling
for public API session tokens. When a user logs out of the Rancher UI,
the browser session cookies are cleared, but the corresponding server-side
session token is not removed from its backing store. As a result, the
session token remains valid and continues to authenticate API requests
until its configured time-to-live or idle timeout expires.

Logout is the primary control available to users and administrators to
immediately terminate a session that is suspected to be compromised.
Because this control does not take effect server-side, a session that
a user believes to have been terminated can still be used.

Preconditions

Exploitation of this issue requires the following conditions:

Rancher is configured with an authentication provider that issues
external session tokens (for example, OIDC-based providers such as
Generic OIDC, Keycloak, or Azure AD).
The attacker has already obtained a valid session token belonging
to the victim through a separate means outside this flaw (for 
, client-side compromise, or leakage through an intermediary proxy,
cache, or log).
The victim subsequently logs out, expecting the session to be
revoked.

An attacker who meets these prerequisites retains authenticated
access with the victim's identity and permissions, including
administrative privileges where applicable, for the remaining
lifetime of the token, despite the victim's logout.

Deployments that do not use public API session tokens are not
affected; legacy Rancher API tokens are revoked correctly on
logout.

Patches
The fix corrects the internal routing of the session token
identifier during logout. The logout handler now passes the fully
qualified token identifier to the token deletion logic, so public
API session tokens are deleted from the correct backing store
instead of being silently treated as legacy tokens. The deletion
path also logs cases where the requested token is not found, so
that misrouted deletions are no longer invisible.

Unit test coverage was added for the public API session token
logout path, which was previously exercised only for legacy
tokens.

This change is not a breaking change and requires no user action
beyond upgrading. Sessions issued before the upgrade are revoked
normally once the patched version is running.

Rancher v2.15.2 includes the fix for this issue.

Workarounds
There is no complete workaround other than upgrading to a patched
version.

If organizations are unable to upgrade immediately, some partial
mitigations are:

Reduce the session token time-to-live and idle timeout settings
in Rancher so that a session that is not revoked at logout
expires sooner.

Administrators can delete the affected user's active session tokens
directly (for example, by removing the user's tokens through the
Rancher API or by disabling the user account) when immediate
revocation is required.

Follow standard session-protection practices — enforce TLS end to
end, avoid logging or caching authorization headers at intermediary
proxies, and restrict the use of untrusted browser extensions on
workstations used to administer Rancher — to reduce the likelihood
of a session token being captured in the first place.


References
rancher/rancher#57294 — fix deletion misrouting, plus unit tests
rancher/rancher#57293 — fix deletion misrouting, plus unit tests (release/v2.15)


For more information
If you have any questions or comments about this advisory:

Reach out to the SUSE Rancher Security team for security related inquiries.
Open an issue in the Rancher repository.
Verify our support matrix and product support life cycle.


Severity
High
7.4/ 10

CVSS v4 base metrics
Exploitability Metrics
Attack Vector
Network
Attack Complexity
Low
Attack Requirements
Present
Privileges Required
None
User interaction
Active
Vulnerable System Impact Metrics
Confidentiality
High
Integrity
High
Availability
None
Subsequent System Impact Metrics
Confidentiality
None
Integrity
None
Availability
None
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

CVE ID
CVE-2026-88805

Weaknesses
WeaknessCWE-287
WeaknessCWE-613

Credits
@0insight 0insight
Finder

=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================