CVE-2026-71403
Published:September 03, 2026
Updated:September 22, 2026
A flaw was found in Rancher Manager. The /v3/users update path did not enforce immutability of a User resource's "username" and "principalIds" fields. A user holding the "update" verb on "users.management.cattle.io" could inject a foreign identity provider principal into any account, so that the next login by the owner of that principal was bound to the victim's account and inherited its role bindings.
This issue affects Rancher: before 2.15.1.
Affected Packages
https://github.com/rancher/rancher.git (GITHUB):
Affected version(s) >=v1.0.0 <v2.15.1Fix Suggestion:
Update to version v2.15.1github.com/rancher/rancher (GO):
Affected version(s) >=v0.0.0-20141203052530-c1f15ae2a1ba <v0.0.0-20260827224206-8c257d748d23Fix Suggestion:
Update to version v0.0.0-20260827224206-8c257d748d23Related Resources (4)
Do you need more information?
Contact UsCVSS v4
Base Score:
8.4
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
HIGH
User Interaction
PASSIVE
Vulnerable System Confidentiality
HIGH
Vulnerable System Integrity
HIGH
Vulnerable System Availability
NONE
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
6.1
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
NONE
Weakness Type (CWE)
Authorization Bypass Through User-Controlled Key
EPSS
Base Score:
0.21