CVE-2026-75035: 
Rancher vulnerability analysis and mitigation

CVE-2026-75035 is an authorization bypass vulnerability in SUSE Rancher Manager affecting all versions before 2.15.1. When a non-administrative authenticated user supplies a label selector referencing a different user, the ext.cattle.io/v1 Token store incorrectly drops its internal owner filter instead of returning an empty result, allowing any authenticated user to list and watch every other user's tokens. This discloses token metadata and the stored salted hash of the bearer token. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 base score of 7.1 (High) (Rancher v2.15.1 Release, Feedly).

The root cause is classified as CWE-639 (Authorization Bypass Through User-Controlled Key). The ext.cattle.io/v1 Token store in Rancher's imperative ext Token API applies an internal owner filter to scope token listings to the requesting user. However, when a caller provides a label selector that references a different user's identity, the store logic erroneously discards the owner filter entirely rather than intersecting it with the user-supplied selector or returning an empty result. This allows any low-privileged, authenticated network user to issue crafted list or watch API requests against the token store and enumerate all users' token metadata and bearer token hashes. No special privileges beyond a valid Rancher account are required (Rancher v2.15.1 Release, Feedly).

Successful exploitation allows any authenticated Rancher user to enumerate all other users' token metadata and retrieve the stored salted hashes of bearer tokens, representing a significant confidentiality breach. While integrity and availability are not directly impacted, exposure of bearer token hashes could facilitate offline cracking attempts or token reuse, potentially enabling account takeover and lateral movement across managed Kubernetes clusters. The scope of affected assets includes all users and service accounts with tokens managed by the Rancher ext.cattle.io/v1 Token API on vulnerable deployments (Rancher v2.15.1 Release, Feedly).

As of the time of publication, there are no known public proof-of-concept exploits, exploit kits, or confirmed in-the-wild exploitation of CVE-2026-75035. The EPSS score is approximately 0.20%, indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. NVD's SSVC assessment classifies exploitation as "none" with partial technical impact (Feedly).

1. Authentication: Log in to the target Rancher instance with any valid user account (no administrative privileges required).
2. Craft a malicious label selector: Construct a list or watch API request to the ext.cattle.io/v1 tokens endpoint, supplying a label selector that references a different user's identity (e.g., labelSelector=field.cattle.io/token-user-id=<target-user-id>).
3. Send the request: Issue the crafted HTTP GET request to the Rancher API server, e.g., GET /ext.cattle.io/v1/tokens?labelSelector=field.cattle.io/token-user-id=<victim-user-id>.
4. Receive unauthorized token data: Due to the owner filter being dropped, the API returns token metadata and stored bearer token hashes for the targeted user instead of an empty result.
5. Leverage disclosed data: Use the obtained token hashes for offline cracking or attempt to reuse token material to impersonate other users and escalate access across managed clusters (Rancher v2.15.1 Release, Feedly).

• Network: Unusual GET or WATCH requests to /ext.cattle.io/v1/tokens with labelSelector parameters referencing user IDs other than the authenticated caller's own ID.
• Logs: Rancher API audit logs showing authenticated low-privilege users performing list or watch operations on the ext.cattle.io/v1 tokens resource with cross-user label selectors; repeated token enumeration requests from a single user account in a short time window.
• Logs: Entries in Rancher audit logs where the requesting user's ID does not match the user ID specified in the label selector of the token list/watch request.

Upgrade Rancher to version 2.15.1 or later, which enforces per-user scoping unconditionally on the ext.cattle.io/v1 Token store and removes the stored token hash from read responses. No configuration-based workaround is documented; upgrading is the only recommended remediation. Administrators should also rotate all user tokens after upgrading as a precautionary measure, given that token hashes may have been exposed (Rancher v2.15.1 Release).

The vulnerability was disclosed alongside several other security fixes in the Rancher v2.15.1 release notes, which addressed five CVEs simultaneously. No notable independent researcher commentary, social media discussion, or significant media coverage specific to CVE-2026-75035 has been identified beyond standard CVE tracking and aggregator sites (Rancher v2.15.1 Release).