Read the docs
TI-2026-50040 Aliases CVE-2026-71403

Rancher: Identity-field mutation in /v3/users allows account hijack via principal rebind

Priority LOW 29CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Required
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-639.

Summary

A flaw was found in Rancher Manager. The /v3/users update path did not enforce immutability of a User resource's `username` and `principalIds` fields. A user holding the `update` verb on `users.management.cattle.io` could inject a foreign identity provider principal into any account, so that the next login by the owner of that principal was bound to the victim's account and inherited its role bindings. This issue affects Rancher: before 2.15.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00369 30th percentileScored 2026-11-07
Fix Fixed Rancher (SUSE): 2.15.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SUSERancherbefore 2.15.12.15.1Patch availableCNA
  • Rancher VendorSUSE Affected before 2.15.1 Fixed in 2.15.1 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*before 2.15.1VulnerableSUSE
  • cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:* Versions before 2.15.1 Vulnerable ·SUSE

Remediation

  • Fix · CNA Rancher (SUSE) Fixed in 2.15.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    SUSE Rancher 2.15.1

    5 records Highest priority Priority MEDIUM 1 MEDIUM, 4 LOW

    Other records, highest priority first

    • TI-2026-50041 Rancher: Ownership-less ClusterRole overwrite via attacker-controlled cr-name annotation on GlobalRolePriority MEDIUM 40
    • TI-2026-52725 Rancher: SAML Assertion ReplayPriority LOW 34
    • TI-2026-52724 Rancher: Cross-Cluster Secret Leakage via Namespace projectId Annotation SpoofingPriority LOW 34
    Show all 5 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-71403

References

Patch 1

  • TI-2021-14903 Rancher: Plaintext storage and exposure of credentials in Rancher API and cluster.management.cattle.io object CVSS 3.1CRITICAL 9.9
  • TI-2022-21489 Rancher: Non-random authentication token CVSS 3.1CRITICAL 9.8
  • TI-2019-08380 An issue was discovered that affects the following versions of Rancher: v2.0.0 through… CVSS 3.0CRITICAL 9.8
  • TI-2023-08827 Improper privilege management in SUSE Rancher CVSS 3.1CRITICAL 9.9
  • TI-2023-08823 Improper privilege management in SUSE Rancher CVSS 3.1CRITICAL 9.9
  • TI-2022-21491 Rancher: Exposure of sensitive fields CVSS 3.1CRITICAL 9.9
See all 35 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences