CVE-2026-71403 PUBLISHED

Rancher: Identity-field mutation in /v3/users allows account hijack via principal rebind

Assigner: suse
Reserved: 06.08.2026 Published: 03.09.2026 Updated: 03.09.2026

A flaw was found in Rancher Manager. The /v3/users update path did not enforce immutability of a User resource's username and principalIds fields. A user holding the update verb on users.management.cattle.io could inject a foreign identity provider principal into any account, so that the next login by the owner of that principal was bound to the victim's account and inherited its role bindings.

This issue affects Rancher: before 2.15.1.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N
CVSS Score: 6.1

Product Status

Vendor SUSE
Product Rancher
Versions Default: unaffected
  • affected from 0 to 2.15.1 (excl.)

Credits

  • Andrej Tomči finder

References

Problem Types

  • CWE-639 Authorization bypass through User-Controlled key CWE

Impacts

  • CAPEC-21 Exploitation of Trusted Identifiers
  • CAPEC-151 Identity Spoofing
  • CAPEC-593 Session Hijacking