CVE-2026-88805 HIGH

CVE-2026-88805: Session Not Revoked Server-Side on Logout in Rancher

Vendor Suse

Product Rancher

Weakness CWE-613 · Insufficient session expiration

Published September 28, 2026

Last update September 28, 2026

View on NVD All CVEs

CVSS base score

8.1/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction Required

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

What the vulnerability does

01Description

Incorrect credential cleaning on logout could be used by remote attackers to keep access credentials even after the account was logged out. Affected is SUSE Rancher 2.15 before 2.15.2.

Key dates

02Disclosure timeline

September 28, 2026 CVE published

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-88805 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/613.html AskarLabs — CWE-613 write-up Insufficient Session Expiration

Related vulnerabilities

CVE-2026-88805: Session Not Revoked Server-Side on Logout in Rancher

01Description

02Disclosure timeline

03References

04Related CVE