# Rancher Release v2.15.2 **URL:** \ **Category:** Announcements\ **Created:** [September 23, 2026, 10:51pm UTC](https://forums.suse.com/t/rancher-release-v2-15-2/46506 "2026-09-23T22:51:38Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![Jono-SUSE-Rancher](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/jono-suse-rancher/32/7319_2.png) [@Jono-SUSE-Rancher](https://forums.suse.com/u/Jono-SUSE-Rancher)\ **Post date:** [September 23, 2026, 10:51pm UTC](https://forums.suse.com/t/rancher-release-v2-15-2/46506/1 "2026-09-23T22:51:38Z")
# Release v2.15.2 > [!IMPORTANT] > > - If you are using Active Directory Federation Service (AD FS), upgrading to Rancher v2.10.1 or later may cause issues with authentication, requiring manual intervention. These issues are due to the AD FS Relying Party Trust not being able to pick up a signature verification certificate from the metadata. For more information, see [#48655](https://github.com/rancher/rancher/issues/48655). These issues can be corrected by either of two methods: Rancher v2.15.2 is the latest patch release of Rancher. This is a Community version release that introduces maintenance updates and bug fixes. For more information on new features in the general minor release, see the [v2.15.0 release notes](https://github.com/rancher/rancher/releases/tag/v2.15.0). ## Security Fixes for Vulnerabilities This release addresses the following security issues: ### Rancher - Fixed a security vulnerability in Rancher where logging out cleared the browser session cookies but did not delete the corresponding public API session token on the server. A previously captured session token therefore remained valid until its natural expiry, defeating logout as a revocation control. Only deployments using public API session tokens in, for example, OIDC-based authentication, were affected. For more information, refer to [CVE-2026-88805](https://github.com/rancher/rancher/security/advisories/GHSA-6vpq-mf48-9794). - Fixed a security vulnerability in Rancher where a small set of public UI settings served by unauthenticated, read-only API routes could be modified by a remote unauthenticated user. Because one of those settings is rendered as raw HTML on the login page, attacker-controlled content could be stored and executed in the browser of users accessing the login page, potentially exposing the local administrator bootstrap password or an active administrator session. The unauthenticated settings routes are now strictly read-only. For more information, see [CVE-2026-88804](https://github.com/rancher/rancher/security/advisories/GHSA-992f-xh8r-jg2f). ### Fleet - Fixed a security vulnerability in Fleet where Helm `valuesFiles` entries in `fleet.yaml` were not confined to the bundle directory. A user able to supply untrusted bundle content could cause Fleet to read files outside the repository checkout and expose their contents through the generated `Bundle`, including credential material the user had no permission to read. Fleet now rejects values file paths that escape the bundle directory. For more information, refer to [CVE-2026-93537](https://github.com/rancher/fleet/security/advisories/GHSA-wpfm-r97v-3j4h). - Fixed an issue where the Fleet agent copied the Secrets and ConfigMaps listed in a Bundle’s `downstreamResources`, and created the deployment’s target namespace, using the agent’s own credentials instead of the ServiceAccount pinned to the deployment. Those writes are now gated by the tenant’s downstream RBAC. Deployments that do not pin a ServiceAccount are unchanged as an agent operation. Rancher v2.15.x is affected in a default installation, because the resource copy is always enabled there. After upgrading, a deployment that pins a ServiceAccount without permission to create the target namespace, or to write the copied Secrets and ConfigMaps in it, will no longer deploy. It reports “not ready” and retries until the permission is granted. Grant the ServiceAccount the missing permissions, or pre-create the target namespace. For more information, refer to [CVE-2026-88808](https://github.com/rancher/fleet/security/advisories/GHSA-q9v4-358v-r8q5). - Fixed a security vulnerability in Fleet’s Git webhook receiver where when a webhook secret was not configured, an unauthenticated caller with network access to the webhook service could change the polling interval of `GitRepo` resources in any namespace, delaying the rollout of legitimate Git changes. Fleet now only applies webhook-triggered changes to `GitRepo` specifications for requests verified against a configured webhook secret. For more information, refer to [CVE-2026-93539](https://github.com/rancher/fleet/security/advisories/GHSA-8vfv-33cg-g75q). ## Rancher General ### Major Bug Fixes - Fixed a known issue with Kubernetes v1.36 clusters where **Rancher Backups** is not listed under the **Cluster Tools** due to a Backups chart issue. See [#1055](https://github.com/rancher/backup-restore-operator/pull/1055). ## Authentication ### Major Bug Fixes - The ext.Kubeconfig store has been updated to align with standard Kubernetes API resource behavior. See [#56341](https://github.com/rancher/rancher/issues/56341). ## Role-Based Access Control (RBAC) ### Major Bug Fixes - Fixed the reconciler loop for Global Roles that contain the `inheritedFleetWorkspacePermissions` field. The fix prevents Rancher logs from being spammed with create/delete operations. See [#57050](https://github.com/rancher/rancher/issues/57050). - Extended Rancher to better protect its managed resources for limit ranges and resource quotas from interference by regular users. ## Cluster Provisioning ### Major Bug Fixes - Fixed an issue where the GKE provisioning UI offered Kubernetes versions that are not supported by any GKE release channel. Rancher now shows only valid GKE versions for release-channel-based provisioning, preventing users from selecting versions that cannot be used to provision new clusters. See [#18928](https://github.com/rancher/dashboard/issues/18928) and [#56879](https://github.com/rancher/rancher/issues/56879). ### Known Issues - There is a known issue with provisioned clusters deletion where such clusters get stuck if they have s3 snapshots. A workaround is to delete all left over s3 `etcdsnapshots.rke.cattle.io` objects belonging to the cluster that are present within the local cluster. See [#57506](https://github.com/rancher/rancher/issues/57506) and the [issue comment](https://github.com/rancher/rancher/issues/57506#issuecomment-5784025617) for more information. ## Changes Since v2.15.1 See the full list of [changes](https://github.com/rancher/rancher/compare/v2.15.1%E2%80%A6v2.15.2). ## Install/Upgrade Notes If you’re installing Rancher for the first time, your environment must fulfill the [installation requirements](https://ranchermanager.docs.rancher.com/v2.15/getting-started/installation-and-upgrade/installation-requirements). > [!IMPORTANT] > > - Rancher now requires the cluster it runs on to have the [Kubernetes API Aggregation Layer](https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/apiserver-aggregation/) enabled. This is because Rancher extends Kubernetes with additional APIs by registering its own extension API server. Please note that all versions of Kubernetes supported in this Rancher versions K8s distributions (RKE2/K3s) will have the aggregation layer configured and enabled by default. > > - Rancher Kubernetes Engine (RKE/RKE1) has reached end of life as of **July 31, 2025**. Rancher versions 2.12.0 and later no longer support provisioning or managing downstream RKE1 clusters. We recommend replatforming RKE1 clusters to RKE2 to ensure continued support and security updates. Learn more about the transition [here](https://www.suse.com/support/kb/doc/?id=000021518). > > - It is crucial that you review the available disk space on your nodes and plan accordingly before upgrading to Rancher v2.12.0 and later to avoid potential disk pressure and pod eviction issues. > > - Rancher now has an enablement option called [`AUDIT_LOG_ENABLED`](https://ranchermanager.docs.rancher.com/v2.15/how-to-guides/advanced-user-guides/enable-api-audit-log#viewing-api-audit-logs:~:text=Description-,AUDIT_LOG_ENABLED,-false%20%2D%20Disables%20the) for API Audit Logs for a Rancher installation. ## Changes in Image Artifacts Image artifact digests are renamed in Rancher v2.12.0, v2.11.4 and v2.10.8. Up until this change, separate image digests files for each operating system and architecture have been maintained for compatibility reasons. With this change, only one file for each operating system is to be provided: - The `rancher-images-digests-linux-amd64.txt` and `rancher-images-digests-linux-arm64.txt` files are to be renamed to `rancher-images-digests-linux.txt`. - The `rancher-images-digests-windows-ltsc2019.txt` and `rancher-images-digests-windows-ltsc2022.txt` files are to be renamed to `rancher-images-digests-windows.txt`. ## Upgrade Requirements - **Creating backups:** [Create a backup](https://ranchermanager.docs.rancher.com/v2.15/how-to-guides/new-user-guides/backup-restore-and-disaster-recovery/back-up-rancher) before you upgrade Rancher. To roll back Rancher after an upgrade, you must first back up and restore Rancher to the previous Rancher version. Because Rancher will be restored to the same state as when the backup was created, any changes post-upgrade will not be included after the restore. - **Helm version requirements:** - **CNI requirements:** - **Requirements for air-gapped environments:** ## Versions ### Images - rancher/rancher:v2.15.2 ### Tools - CLI - [v2.15.2](https://github.com/rancher/cli/releases/tag/v2.15.2) ### Kubernetes Versions for RKE2/K3s - v1.36.4 (Default) - v1.35.8 - v1.34.11 ### Rancher Helm Chart Versions In Rancher v2.6.0 and later, in the **Apps & Marketplace** UI, many Rancher Helm charts are named with a major version that starts with _100_. This avoids simultaneous upstream changes and Rancher changes from causing conflicting version increments. This also complies with semantic versioning (SemVer), which is a requirement for Helm. You can see the upstream version number of a chart in the build metadata, for example: `100.0.0+up2.1.0`. See [#32294](https://github.com/rancher/rancher/issues/32294). ## Previous Rancher Behavior Changes ### Previous Rancher Behavior Changes - Rancher General - **Rancher v2.15.0:** ### Previous Rancher Behavior Changes Changes - Rancher App (Global UI) - **Rancher v2.15.0:** ### Previous Rancher Behavior Changes - K3s and RKE2 Provision - **Rancher v2.15.0:** ### Previous Rancher Behavior Changes - Continuous Delivery (Fleet) - **Rancher v2.15.0:** ### Long-standing Known Issues - Cluster Provisioning - **Rancher v2.15.1:** - Not all cluster tools can be installed on a hardened cluster. - **Rancher v2.8.1:** ### Long-standing Known Issues - RKE2 Provisioning - **Rancher v2.7.7:** - **Rancher v2.7.6:** ### Long-standing Known Issues - K3s Provisioning - **Rancher v2.7.6:** - **Rancher v2.7.2:** ### Long-standing Known Issues - Rancher App (Global UI) - **Rancher v2.10.0:** - **Rancher v2.9.2:** - **Rancher v2.7.7:** - **Rancher v2.6.4:** ### Long-standing Known Issues - EKS - **Rancher v2.7.0:** ### Long-standing Known Issues - Authentication - **Rancher v2.9.0:** ### Long-standing Known Issues - Rancher Webhook - **Rancher v2.7.2:** ### Long-standing Known Issues - Virtualization Management (Harvester) - **Rancher v2.13.1:** - **Rancher v2.7.2:** ### Long-standing Known Issues - Backup/Restore - When migrating to a cluster with the Rancher Backup feature, the server-url cannot be changed to a different location. It must continue to use the same URL. - **Rancher v2.13.0:** - **Rancher v2.7.7:** ---
**Author:** ![Jono-SUSE-Rancher](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/jono-suse-rancher/32/7319_2.png) [@Jono-SUSE-Rancher](https://forums.suse.com/u/Jono-SUSE-Rancher)\ **Post date:** [September 23, 2026, 10:51pm UTC](https://forums.suse.com/t/rancher-release-v2-15-2/46506/2 "2026-09-23T22:51:43Z")