CVE-2026-75035 — Rancher: ext.cattle.io/v1 Token store: cross-user token disclosure via label-selector scoping bypass

CVE-2026-75035

Rancher: ext.cattle.io/v1 Token store: cross-user token disclosure via label-selector scoping bypass PUBLISHED

Description (CNA)

A flaw was found in Rancher Manager. When a non-administrative caller supplied a label selector naming a different user, the ext.cattle.io/v1 Token store dropped its internal owner filter instead of returning an empty result. Any authenticated user could therefore list and watch every other user's tokens, disclosing token metadata and the stored salted hash of the bearer token. This issue affects Rancher: before 2.15.1.

Affected (CNA)

Vendor / product	Versions
SUSE / Rancher	affected 0 before 2.15.1

CWE

CWE-639

References

https://github.com/rancher/rancher/releases/tag/v2.15.1

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.