SUSE Linux security advisory (AV26-1053)
Canadian Cyber Centre relays SUSE fixes for Rancher project access flaws and Steve certificate-validation weaknesses.
On October 15, 2026, the Canadian Centre for Cyber Security published advisory AV26-1053 covering SUSE vulnerabilities in Rancher and Steve. Rancher versions before 2.10.5, 2.11.1, and 2.9.9 allow users who can create Projects to access arbitrary projects. Steve versions before 0.2.1, 0.3.3, 0.4.4, and 0.5.13 do not verify server certificates and are susceptible to man-in-the-middle attacks. The centre urges administrators to review SUSE updates and apply them.
- Rancher project creators can access arbitrary projects.
- Steve skips server certificate checks, enabling MitM.
- Affected Rancher releases predate 2.9.9, 2.10.5, and 2.11.1.
- Cyber Centre urges review of SUSE updates.
Full article93 words · extracted from cyber.gc.ca · click to collapse
Serial number: AV26-1053
Date: October 15, 2026
As of October 15, 2026, SUSE is affected by vulnerabilities in the following products:
- Rancher
- Prior to 2.10.5
- Prior to 2.11.1
- Prior to 2.9.9
- Steve
- Prior to 0.2.1
- Prior to 0.3.3
- Prior to 0.4.4
- Prior to 0.5.13
The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.
Text extracted automatically; images, tables and formatting may be missing. Original: https://cyber.gc.ca/en/alerts-advisories/suse-linux-security-advisory-av26-1053