CVE-2026-71403

A flaw was found in Rancher Manager. The /v3/users update path did not enforce immutability of a User resource's `username` and `principalIds` fields. A user holding the `update` verb on `users.management.cattle.io` could inject a foreign identity provider principal into any account, so that the next login by the owner of that principal was bound to the victim's account and inherited its role bindings. This issue affects Rancher: before 2.15.1.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/rancher/rancher/pull/56616	Issue Tracking Patch

Configurations

Configuration 1 (hide)

cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*

History

18 Sep 2026, 15:03

Type	Values Removed	Values Added
References	~~() https://github.com/rancher/rancher/pull/56616 -~~	() https://github.com/rancher/rancher/pull/56616 - Issue Tracking, Patch
CPE		cpe:2.3:a:suse:rancher::::::::
First Time		Suse Suse rancher

Information

Published : 2026-09-03 15:17

Updated : 2026-09-18 15:03

NVD link : CVE-2026-71403

Mitre link : CVE-2026-71403

CVE.ORG link : CVE-2026-71403

JSON object : View

Products Affected

suse

rancher

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

{"id": "CVE-2026-71403", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-71403", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-09-03T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "meissner@suse.de", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 0.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 0.9}]}, "affected": [{"source": "meissner@suse.de", "affectedData": [{"repo": "https://github.com/rancher/rancher", "vendor": "SUSE", "modules": ["Manager"], "product": "Rancher", "versions": [{"status": "affected", "version": "0", "lessThan": "2.15.1", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-09-03T15:17:32.180", "references": [{"url": "https://github.com/rancher/rancher/pull/56616", "tags": ["Issue Tracking", "Patch"], "source": "meissner@suse.de"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "meissner@suse.de", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in Rancher Manager. The /v3/users update path did not enforce immutability of a User resource's `username` and `principalIds` fields. A user holding the `update` verb on `users.management.cattle.io` could inject a foreign identity provider principal into any account, so that the next login by the owner of that principal was bound to the victim's account and inherited its role bindings.\n\n\nThis issue affects Rancher: before 2.15.1."}], "lastModified": "2026-09-18T15:03:02.433", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C911F079-FC7A-48EB-9A06-C86AFC6FC1AD", "versionEndExcluding": "2.15.1"}], "operator": "OR"}]}], "sourceIdentifier": "meissner@suse.de"}