Rancher Manager: Privilege escalation via GlobalRole inheritedNamespacedRules
Summary
SUSE Rancher Manager does not validate the inheritedNamespacedRules field of a GlobalRole for privilege escalation. An authenticated user who is already allowed to create or update GlobalRoles and create GlobalRoleBindings can obtain permissions in named namespaces of all downstream clusters that exceed their own permissions. Per the vendor, administrators are expected to hold these permissions, so this is not an escalation for them. The impact on confidentiality, integrity and availability is limited to the affected namespaces, but it spans every managed downstream cluster.
Affected
- SUSE Rancher 2.15.2 (vendor table: 2.15.2 to before 2.15.3). The advisory also states 2.15.0 and later are affected; 2.15.0 and 2.15.1 are unclear, do not assume they are safe.
- SUSE Rancher Webhook 0.11.0 to before 0.11.4
- SUSE Rancher Webhook 0.12.0 to before 0.12.1
- Rancher 2.14.x, 2.13.x and earlier: not affected according to the vendor.
Fixed in
- Rancher 2.15.3
- Rancher Webhook 0.11.4 (used by Rancher 2.15.3)
- Rancher Webhook 0.12.1
Workaround
Unknown. The vendor states there is no workaround that fully addresses this issue. Reduce exposure until patched:
- Restrict who can create or update GlobalRoles and create GlobalRoleBindings; grant these only to trusted administrators.
- Audit existing GlobalRole objects for unintended inheritedNamespacedRules entries and remove them.
- Check that GlobalRoleBindings with such roles are bound only to intended users and groups.
- Review downstream cluster RBAC for roles and bindings not created by an authorized administrator.
Exploitation
- Not known to be exploited; no evidence of active exploitation found.
- No public proof-of-concept found; status treated as unknown given the recent publication.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
- Not listed in CISA KEV according to one third-party source.
Our recommendation
- Confirm your Rancher version and upgrade to Rancher 2.15.3 (or Rancher Webhook 0.11.4 or 0.12.1 where used separately).
- Until patched, apply the workarounds above and limit delegated global role management.
- After upgrading, review existing GlobalRoles and GlobalRoleBindings for unexpected inheritedNamespacedRules entries, as objects created before the fix are not retroactively validated.
- Monitor changes to GlobalRoles and GlobalRoleBindings.
- Note: NVD analysis is pending; CWE and affected-version details differ between sources.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-f898-2c8h-r7jc (rancher/webhook) github.com
- SUSE Rancher security advisories and CVEs ranchermanager.docs.rancher.com
- Rancher releases github.com
- VulDB entry for CVE-2026-88810 vuldb.com
- OffSeq threat radar for CVE-2026-88810 radar.offseq.com
- Strix CVE-2026-88810 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 3 Nov 2026, 02:44.
Original description (NVD)
A privilege escalation issue was discovered in Rancher Manager's role-based access control. The inheritedNamespacedRules field of a GlobalRole propagates permissions into named namespaces of every downstream cluster managed by the Rancher instance, but it was not subject to the privilege-escalation validation applied to the other permission-carrying fields of a GlobalRole. As a result, a non-administrative user could be granted, through a global role binding, permissions in downstream clusters that exceed the permissions that user already holds. This affected SUSE Rancher 2.15.2 only, and SUSE Rancher Webhook 0.11.0 up to 0.11.4, and 0.12.0 up to 0.12.1.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.