CVE-2026-75035CWE-639

CVE-2026-75035

High · published September 3, 2026

CVSS v3.1
7.7
EPSS
0%
Percentile
26.3
In the wild
Unconfirmed
What it is

A flaw was found in Rancher Manager. When a non-administrative caller supplied a label selector naming a different user, the ext.cattle.io/v1 Token store dropped its internal owner filter instead of returning an empty result. Any authenticated user could therefore list and watch every other user's tokens, disclosing token metadata and the stored salted hash of the bearer token.

This issue affects Rancher: before 2.15.1.

The record
Technical detail
CVSS v3.1
7.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00340 · 26.3th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-09-03T20:18Z
Affected products (1)
ProductVersionsFixed in
suse/rancher< 2.15.12.15.1
References (1)
https://github.com/rancher/rancher/releases/tag/v2.15.1 · [email protected]
EPSS history
Timeline
  • 05 SEP 03:44Z
    EPSS moved — → 0%
    epss
  • 03 SEP 15:07Z
    Rancher: ext.cattle.io/v1 Token store: cross-user token disclosure via label-selector scoping bypass
    cvelistv5