Rancher 2.15.3 and Maintained Branches Fix Five Flaws
Tech GuruQuick Answer
Rancher published five security fixes in maintained Rancher Manager and Fleet releases. Inventory exact branches, proxy use, shell permissions and Fleet controllers, update to the branch-specific release, rotate exposed credentials where evidence warrants it, validate clusters and tenancy, and retain evidence.
Confirm Scope And Apply The Supported Remediation
What to do now: Inventory Rancher Manager and Fleet installations, exact branches and bundled Fleet versions, meta-proxy and cloud-provider integrations, local-cluster shell access, tenant boundaries, registration tokens, owners, backups, and maintenance windows. Map each deployment to the individual CVE and branch; the five issues have different authenticated roles and component paths, so do not infer universal exposure from Rancher presence alone. Upgrade to the maintained Rancher release and Fleet build listed for the deployed branch, restrict proxy and administrative paths during rollout, and rotate session or API credentials only where exposure evidence supports it. Confirm running Rancher and Fleet versions, test proxy destinations, credential stripping, shell authorization, registration and tenant isolation, review relevant audit evidence, and retain change and recovery records.
Last verified: 2026-10-30 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Rancher Manager and Fleet on the maintained 2.11 through 2.15 branches |
|---|---|
| Advisory | CVE-2026-88809 / CVE-2026-88811 / CVE-2026-104623 / CVE-2026-94290 / CVE-2026-104615 |
| CVEs | CVE-2026-104615, CVE-2026-104623, CVE-2026-88809, CVE-2026-88811, CVE-2026-94290 |
| Authoritative release date | 2026-10-29 |
| Authority revision date | 2026-10-29 |
| Affected versions | Issue-specific Rancher Manager and Fleet releases before 2.15.3, 2.14.7, 2.13.11, 2.12.15, or 2.11.19; the Fleet issues apply to the exact branches and bundled Fleet releases listed by Rancher. |
| Fixed version | Rancher 2.15.3, 2.14.7, 2.13.11, 2.12.15, or 2.11.19 as applicable, with Fleet 0.16.3, 0.15.8, 0.14.12, or 0.13.17 for the Fleet advisories |
| CVSS base score | Not provided by the authority |
| CVSS severity | Not provided by the authority |
| Exploitation status | Rancher does not state that these vulnerabilities are being maliciously exploited.; no exploitation claim is inferred. |
What Changed
Rancher fixed meta-proxy internal access and credential leakage, local-cluster shell authorization, Fleet administrative-credential escalation, and Fleet cluster-identity takeover.
What To Validate Now
- Inventory. Inventory Rancher Manager and Fleet installations, exact branches and bundled Fleet versions, meta-proxy and cloud-provider integrations, local-cluster shell access, tenant boundaries, registration tokens, owners, backups, and maintenance windows.
- Establish applicability. Map each deployment to the individual CVE and branch; the five issues have different authenticated roles and component paths, so do not infer universal exposure from Rancher presence alone.
- Remediate. Upgrade to the maintained Rancher release and Fleet build listed for the deployed branch, restrict proxy and administrative paths during rollout, and rotate session or API credentials only where exposure evidence supports it.
- Validate. Confirm running Rancher and Fleet versions, test proxy destinations, credential stripping, shell authorization, registration and tenant isolation, review relevant audit evidence, and retain change and recovery records.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Management-plane and Fleet upgrades can affect downstream clusters and GitOps delivery. Back up configuration, stage HA changes, preserve evidence, and use only the matching supported branch.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
