EUVD-2026-70517Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable Token API requires authenticated session (PR:L); impact is confidentiality-only via token metadata and hash disclosure with no integrity or availability consequence.
Primary rating from Vendor (suse).
CVSS VectorVendor: suse
Lifecycle Timeline
8DescriptionCVE.org
A flaw was found in Rancher Manager. When a non-administrative caller supplied a label selector naming a different user, the ext.cattle.io/v1 Token store dropped its internal owner filter instead of returning an empty result. Any authenticated user could therefore list and watch every other user's tokens, disclosing token metadata and the stored salted hash of the bearer token.
This issue affects Rancher: before 2.15.1.
AnalysisAI
Token store authorization bypass in Rancher Manager before 2.15.1 allows any authenticated user to enumerate every other user's session tokens by supplying a crafted label selector to the ext.cattle.io/v1 Token API. The owner-scoped filter that restricts results to the calling user's own tokens is silently dropped when the caller supplies a label selector naming a different user, instead of returning an empty result set as intended. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must hold any valid authenticated Rancher account - no administrative role or elevated privilege is required (PR:L per CVSS 4.0 vector). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N scores 7.1 (High) and accurately characterizes the risk: the flaw is network-reachable with low complexity, but exploitation requires a valid authenticated Rancher session (PR:L), which meaningfully narrows the attacker pool relative to an unauthenticated flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Rancher Manager to version 2.15.1 or later per the vendor release at https://github.com/rancher/rancher/releases/tag/v2.15.1. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Rancher Manager deployments and document their current versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
An Improper Authorization vulnerability in SUSE Rancher, allows any user who has permissions to create/edit cluster role
A Cleartext Transmission of Sensitive Information vulnerability in SUSE Rancher, Rancher allows attackers on the network
Improper Privilege Management vulnerability in SUSE Rancher allows Privilege Escalation. Rated critical severity (CVSS 9
A Improper Access Control vulnerability in Rancher, allows users in the cluster to make request to cloud providers by cr
An issue was discovered that affects the following versions of Rancher: v2.0.0 through v2.0.13, v2.1.0 through v2.1.8, a
Command injection in Rancher Manager’s cluster import endpoint enables remote attackers to deploy malicious containers o
SAML assertion replay in Rancher's Assertion Consumer Service (ACS) handler lets a person-in-the-middle who captures a v
Privilege escalation in SUSE Rancher (Kubernetes management platform) allows a user holding the Project Owner role to im
Rancher Labs rancher server 1.2.0+ is vulnerable to authenticated users disabling access control via an API call. Rated
Privilege escalation in Rancher 2.13 (before 2.13.6) and 2.14 (before 2.14.2) lets any authenticated user gain principal
Cleartext registration token exposure in Rancher allows a low-privileged user to obtain perpetually valid cluster join t
A Improper Privilege Management vulnerability in SUSE Rancher causes permission changes in Azure AD not to be reflected
Vendor StatusVendor
SUSE
Severity: ImportantShare
External POC / Exploit Code
Leaving vuln.today