{"vulnerability": "cve-2026-88804", "sightings": [{"uuid": "ae66c9a1-cecb-4ca8-bbae-d500c847e623", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88804", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mwaaou7nlo2f", "content": "A critical Rancher XSS vulnerability tracked as CVE-2026-88804 exposes admin sessions. Update your clusters immediately to prevent system compromise.\n\n#Rancher #Kubernetes #CVE202688804 #XSS #Cybersecurity #Infosec", "creation_timestamp": "2026-09-24T02:50:30.663892Z"}, {"uuid": "9f927ee2-8c6d-4adf-b603-a092d9ef6103", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88804", "type": "published-proof-of-concept", "source": "https://t.me/HackingTeamGrupoOfficial/49396", "content": "CVE-2026-88804: Unauthenticated update of public UI settings leading to stored XSS in Rancher, 9.4 Rating \ud83d\udd25\n\nAn unauthenticated attacker can plant malicious content that runs in the browser of anyone visiting the Rancher login page. This can leak the local administrator bootstrap password or hijack an active admin session, leading to complete control of the Rancher installation and its managed downstream clusters.\n\nSearch at Netlas.io:\n\ud83d\udc49 Link: https://nt.ls/dtxM5\n\ud83d\udc49 Dork: http.favicon.hash_sha256:2d7adbc74e7c8941927d04e702acbff577d219fef8617c8c3014d34ae395525b OR http.body:\"Rancher\" OR http.unknown_headers.key:\"x_api_cattle_auth\"\n\nVendor's advisory:\nhttps://github.com/rancher/rancher/security/advisories/GHSA-992f-xh8r-jg2f", "creation_timestamp": "2026-09-25T06:40:39.000000Z"}, {"uuid": "20e3c635-63c9-4f9d-9d5e-960458af9bab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88804", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mwlrhwmkss2l", "content": "CVE-2026-88804 - rancher\nIn Rancher versions prior to the latest patches, anyone on the internet can modify public interface settings without logging in. This lets attackers insert hidden scripts that run\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#rancher #suse #CVE #infosec", "creation_timestamp": "2026-09-28T16:50:08.752039Z"}, {"uuid": "31f1ff19-1623-4e58-a912-5e4e6217304f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88804", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/5r2u3t5phofui", "content": "CVE-2026-88804 - Unauthenticated update of public UI settings leading to stored cross-site scripting in Rancher\nCVE ID : CVE-2026-88804\n \n Published : Sept. 28, 2026, 4:17 p.m. | 15\u00a0minutes ago\n \n Description : An unauthenticated update of public UI settings could be used by r...", "creation_timestamp": "2026-09-28T16:58:32.494864Z"}, {"uuid": "c27de90b-64ef-4d28-a7f7-d84440b1b5e2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88804", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mwlvuiamvw2u", "content": "\ud83d\udea8 CVE-2026-88804 \u2014 CVSS 9.6 CRITICAL\n\nAn unauthenticated update of public UI settings could be used by remote attackers to execute a stored cross...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-88804\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-28T18:08:44.851130Z"}]}