CVE-2026-75035

Rancher Manager's ext.cattle.io/v1 Token store contains an authorization flaw (CWE-639): when a non-administrative caller supplies a label selector naming a different user, the API drops its internal owner filter instead of returning an empty result. Any authenticated user can trigger this simply by issuing a list or watch request against the token store with such a selector. The attacker gains read access to metadata for every other user's tokens, including the stored salted hash of each bearer token; the CVSS 4.0 vector (VC:H/VI:N/VA:N) confirms a high-confidentiality-only impact with no integrity or availability effect. All Rancher deployments running a version prior to 2.15.1 are affected, with exposure greatest on multi-user deployments. There is currently no public proof of concept, no entry in CISA's Known Exploited Vulnerabilities catalog, and a low predicted exploitation probability (EPSS 0.2%).

What to do: Upgrade Rancher to 2.15.1 or later. Because any authenticated user on a vulnerable instance could read all users' token metadata and salted bearer-token hashes, check Rancher audit logs for list/watch requests against ext.cattle.io/v1 tokens from unexpected accounts, and revoke and reissue tokens where suspicious activity is found. No workaround is described in the advisory; restricting which accounts can authenticate to Rancher limits exposure until you can patch.