CVE-2026-71403: CWE-639 Authorization bypass through User-Controlled key in SUSE Rancher

This vulnerability in Rancher Manager's /v3/users update path fails to enforce immutability on the username and principalIds fields of User resources. An attacker with the update verb on users.management.cattle.io can inject a foreign identity provider principal into any account. Consequently, when the owner of that principal logs in, their session is bound to the victim's account, inheriting its role bindings and privileges. The issue affects Rancher versions prior to 2.15.1. The CVSS 3.1 score is 6.1 (medium severity), reflecting network attack vector, low attack complexity, high privileges required, and user interaction needed.

Successful exploitation allows an attacker with update permissions on user resources to escalate privileges by associating a foreign identity provider principal with a victim's account. This results in the attacker inheriting the victim's role bindings, potentially gaining unauthorized access to resources and functions within Rancher Manager. There is no indication of availability impact. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 2.15.1, upgrading to version 2.15.1 or later is recommended once a fix is officially released. Until then, restrict update permissions on users.management.cattle.io to trusted administrators only to reduce risk.