CVE search · CVE-2026-71403
CVE-2026-71403
medium 6.1
A flaw was found in Rancher Manager. The /v3/users update path did not enforce immutability of a User resource's `username` and `principalIds` fields. A user holding the `update` verb on `users.management.cattle.io` could inject a foreign identity provider principal into any account, so that the next login by the owner of that principal was bound to the victim's account and inherited its role bindings. This issue affects Rancher: before 2.15.1.
Details
- Status
- Analyzed
- Published
- Last changed
- Source
- meissner@suse.de
- Weakness
- CWE-639
Severity
| Version | Score | Vector | Source |
|---|---|---|---|
| CVSS 3.1 | medium 6.1 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N |
meissner@suse.deSecondary |
| CVSS 3.1 | medium 6.1 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N |
nvd@nist.govPrimary |
Affected products
Vendor and product from the NVD’s CPE applicability statements. Versions and conditions are on the NVD’s page.
- suse · rancher
References
- https://github.com/rancher/rancher/pull/56616Issue TrackingPatch