SUSE Rancher Manager: Server-side request forgery via meta proxy allowlist bypass

Summary

The /meta/proxy endpoint of SUSE Rancher Manager evaluates its destination allowlist in a place where it cannot stop forwarding, so rejected requests are still sent. An authenticated Rancher user can make the Rancher server send requests to internal services and, in some environments, to the cloud instance metadata endpoint, and read the responses. Exploitation requires an HTTP/1.1 request with a full destination URL that reaches Rancher without an HTTP-aware proxy rewriting it, which the default Helm ingress usually blocks but other exposure paths do not.

Affected

• Rancher 2.15.0 to before 2.15.3
• Rancher 2.14.0 to before 2.14.7
• Rancher 2.13.0 to before 2.13.11
• Rancher 2.12.0 to before 2.12.15
• Rancher 2.11.0 to before 2.11.19
• Older EOL versions: potentially affected, no confirmed version list

Fixed in

• Rancher 2.15.3
• Rancher 2.14.7
• Rancher 2.13.11
• Rancher 2.12.15
• Rancher 2.11.19

Workaround

• No workaround fully addresses the issue; upgrading is required.
• Route all access to Rancher through an HTTP-aware reverse proxy or ingress controller instead of a layer 4 load balancer, TLS passthrough, direct Service, hostPort or hostNetwork access.
• Apply NetworkPolicy rules so workload pods cannot reach the Rancher Service ports directly.
• Restrict the Rancher server's egress so it cannot reach internal services or the cloud metadata endpoint.

Exploitation

Unknown. No public proof of concept and no evidence of active exploitation were found at the time of writing.

Our recommendation

• Inventory all Rancher instances and versions, and check for EOL lines below 2.11.
• Upgrade to the fixed version of each branch as soon as possible.
• Apply the network measures above as temporary risk reduction only.
• Review Rancher server logs for suspicious proxy requests; log lines alone do not confirm whether a request was forwarded.
• If exposure is suspected, rotate credentials and API tokens reachable from the Rancher server, including cloud credentials available through instance metadata.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GitHub Security Advisory GHSA-f9gf-wh3x-jx3v github.com
• SUSE Rancher security advisories and CVEs ranchermanager.docs.rancher.com
• Rancher v2.15.3 release github.com
• GitHub Security Advisory GHSA-x82x-2qj6-5rm2 (companion advisory) github.com
• Strix CVE-2026-88809 www.strix.ai
• SUSE Rancher Manager 2.15 CVEs documentation.suse.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 17:37.