CVE-2026-71403
mediumA flaw was found in Rancher Manager.
Vendor / product: Suse — rancher
A flaw was found in Rancher Manager. The /v3/users update path did not enforce immutability of a User resource's `username` and `principalIds` fields. A user holding the `update` verb on `users.management.cattle.io` could inject a foreign identity provider principal into any account, so that the next login by the owner of that principal was bound to the victim's account and inherited its role bindings. This issue affects Rancher: before 2.15.1.
CVSS
6.1
6.1 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2026-09-03 15:17
Modified: 2026-09-18 15:03
NVD status: Analyzed
Last synced 1 day ago
Verified against the source API 2026-10-27 06:50 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
suse / rancher <2.15.1
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Patch / mitigation: https://github.com/rancher/rancher/pull/56616
References
- https://github.com/rancher/rancher/pull/56616 meissner@suse.de
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 06:50 UTC · record ↗