SUSE Linux security advisory (AV26-974)
Canadian Cyber Centre relayed SUSE advisory AV26-974 covering Rancher flaws including stored XSS, session issues, and cross-tenant secret disclosure; patches advised.
The Canadian Centre for Cyber Security issued advisory AV26-974 for SUSE Rancher vulnerabilities affecting numerous versions across release lines up to 2.15.2. The flaws include unauthenticated update of public UI settings leading to stored cross-site scripting, sessions not revoked server-side on logout, Fleet agent copying downstream resources with cluster-admin privileges allowing cross-namespace writes, and cross-tenant BundleDeployment and Secret disclosure via spoofed cluster labels during agent-initiated registration. Users and administrators are urged to apply updates as they become available.
- Multiple Rancher versions affected across release lines through 2.15.2
- Stored XSS via unauthenticated update of public UI settings
- Fleet agent can perform cross-namespace writes with cluster-admin privileges
- Cross-tenant BundleDeployment and Secret disclosure via spoofed cluster labels
- Organizations
- SUSECanadian Centre for Cyber SecurityRancherFleet
From the original article
1 min read at cyber.gc.ca
Serial number: AV26-974 Date: September 29, 2026 As of September 28, 2026, SUSE is affected by vulnerabilities in the following product: Rancher Prior to 0. 12. 19 Prior to 0.
cyber.gc.ca
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.