CVE-2026-75033 — Rancher: Cross-Cluster Secret Leakage via Namespace projectId Annotation Spoofing

CVE-2026-75033

Rancher: Cross-Cluster Secret Leakage via Namespace projectId Annotation Spoofing PUBLISHED

Description (CNA)

A flaw was found in Rancher Manager. Project Secrets were propagated into a namespace based only on its `field.cattle.io/projectId` annotation, without verifying that the referenced project belonged to the same downstream cluster. A user able to create namespaces on one cluster could set the annotation to a project ID from another cluster and have that project's secrets copied into a namespace under their control. This issue affects Rancher: before 2.15.1.

Affected (CNA)

Vendor / product	Versions
SUSE / Rancher	affected 0 before 2.15.1

CWE

CWE-639

References

https://github.com/rancher/rancher/releases/tag/v2.15.1

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.