Skip to content
OpenAdvisories
High WID-SEC-2026-3073 6 CVEs

Rancher: Mehrere Schwachstellen

Published Aug 27, 2026 · Updated Sep 3, 2026 · Revision 2 · de-DE

Vendor: rancher Product: rancher Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in Rancher ausnutzen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen und um Sicherheitsvorkehrungen zu umgehen.

Product

Rancher ist ein Werkzeug für die Verwaltung von Kubernetes-Container basierten Umgebungen.

Vulnerabilities 6

  • High 8.7
    CVE-2026-71404

    Rancher: Ownership-less ClusterRole overwrite via attacker-controlled cr-name annotation on GlobalRole

    A flaw was found in Rancher Manager. The GlobalRole controller derived the target ClusterRole name from the user-settable `authz.management.cattle.io/cr-name` annotation and overwrote that object's rules without verifying ownership. A user with delegated Glob…

    SUSE Rancher
  • High 7.7
    CVE-2026-75033

    Rancher: Cross-Cluster Secret Leakage via Namespace projectId Annotation Spoofing

    A flaw was found in Rancher Manager. Project Secrets were propagated into a namespace based only on its `field.cattle.io/projectId` annotation, without verifying that the referenced project belonged to the same downstream cluster. A user able to create namesp…

    SUSE Rancher
  • High 7.7
    CVE-2026-75035

    Rancher: ext.cattle.io/v1 Token store: cross-user token disclosure via label-selector scoping bypass

    A flaw was found in Rancher Manager. When a non-administrative caller supplied a label selector naming a different user, the ext.cattle.io/v1 Token store dropped its internal owner filter instead of returning an empty result. Any authenticated user could ther…

    SUSE Rancher
  • High 7.4
    CVE-2026-75034

    Rancher: SAML Assertion Replay

    A flaw was found in Rancher Manager. The SAML assertion replay protection introduced by the fix for CVE-2026-44946 recorded consumed assertion IDs in a per-process cache, so each replica only detected replays that reached the same pod. In a high-availability …

    SUSE Rancher
  • Medium 6.1
    CVE-2026-71403

    Rancher: Identity-field mutation in /v3/users allows account hijack via principal rebind

    A flaw was found in Rancher Manager. The /v3/users update path did not enforce immutability of a User resource's `username` and `principalIds` fields. A user holding the `update` verb on `users.management.cattle.io` could inject a foreign identity provider pr…

    SUSE Rancher
  • Medium 5.3
    CVE-2026-75036

    Fleet: DNS exfiltration via Sprig getHostByName in fleet.yaml Helm template preprocessing

    A security vulnerability was discovered in Fleet's Helm template preprocessing where templates evaluated by the Fleet controller could reach network resources outside the management cluster. A user who can supply bundle content to a repository referenced by a…

    SUSE Fleet

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2026-70504, EUVD-2026-70517, EUVD-2026-70501, EUVD-2026-70520, EUVD-2026-70506

  2. #1

    Initiale Fassung

References