{"uuid": "9f927ee2-8c6d-4adf-b603-a092d9ef6103", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88804", "type": "published-proof-of-concept", "source": "https://t.me/HackingTeamGrupoOfficial/49396", "content": "CVE-2026-88804: Unauthenticated update of public UI settings leading to stored XSS in Rancher, 9.4 Rating \ud83d\udd25\n\nAn unauthenticated attacker can plant malicious content that runs in the browser of anyone visiting the Rancher login page. This can leak the local administrator bootstrap password or hijack an active admin session, leading to complete control of the Rancher installation and its managed downstream clusters.\n\nSearch at Netlas.io:\n\ud83d\udc49 Link: https://nt.ls/dtxM5\n\ud83d\udc49 Dork: http.favicon.hash_sha256:2d7adbc74e7c8941927d04e702acbff577d219fef8617c8c3014d34ae395525b OR http.body:\"Rancher\" OR http.unknown_headers.key:\"x_api_cattle_auth\"\n\nVendor's advisory:\nhttps://github.com/rancher/rancher/security/advisories/GHSA-992f-xh8r-jg2f", "creation_timestamp": "2026-09-25T06:40:39.000000Z"}