CVE-2026-75033
Received Received - Intake

Privilege Escalation in Rancher Manager via Project Secrets Propagation

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: SUSE

Description
A flaw was found in Rancher Manager. Project Secrets were propagated into a namespace based only on its `field.cattle.io/projectId` annotation, without verifying that the referenced project belonged to the same downstream cluster. A user able to create namespaces on one cluster could set the annotation to a project ID from another cluster and have that project's secrets copied into a namespace under their control. This issue affects Rancher: before 2.15.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-03
Last Modified
2026-09-03
Generated
2026-09-03
AI Q&A
2026-09-03
EPSS Evaluated
N/A
NVD
CVE-2026-75033
EUVD
EUVD-2026-70506

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
rancher rancher to 2.15.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Rancher Manager allows project secrets to be copied into a namespace based solely on the field.cattle.io/projectId annotation without verifying if the project belongs to the same cluster. An attacker with namespace creation rights on one cluster could set this annotation to reference a project from another cluster, causing its secrets to be leaked into their namespace.

Detection Guidance

Check Rancher Manager version with: kubectl get deployments -n cattle-system -l app=rancher | grep -E '2\.(1[0-4]|[0-9])\.[0-9]+' If version is below 2.15.1, the system is vulnerable. Inspect namespace annotations for field.cattle.io/projectId set to unauthorized project IDs.

Impact Analysis

An attacker could gain access to sensitive project secrets from another cluster, potentially exposing confidential data like credentials, API keys, or other protected information. This could lead to unauthorized access, data breaches, or further exploitation within affected systems.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating confidentiality requirements in GDPR and HIPAA. Organizations may face compliance violations, legal penalties, and reputational damage due to potential data leaks of protected information.

Mitigation Strategies

Upgrade Rancher Manager to version 2.15.1 or later immediately. Review and remove any unauthorized projectId annotations in namespaces. Audit all project-scoped secrets for potential exposure across clusters.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75033. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart