CVE-2026-75033: CWE-639 Authorization bypass through User-Controlled key in SUSE Rancher

The vulnerability arises from Rancher Manager's handling of Project Secrets propagation. Specifically, the system uses the `field.cattle.io/projectId` annotation on namespaces to determine which project secrets to propagate but fails to verify that the project belongs to the same downstream cluster as the namespace. Consequently, a user who can create namespaces on one cluster can manipulate the annotation to reference a project ID from a different cluster, resulting in unauthorized copying of that project's secrets into their namespace. This flaw affects Rancher versions prior to 2.15.1.

An attacker with namespace creation privileges on one cluster can gain unauthorized access to secrets from projects in other clusters by exploiting this flaw. This leads to a confidentiality breach (high impact on confidentiality) since secrets from unrelated clusters can be accessed without proper authorization. There is no direct impact on integrity or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects Rancher versions before 2.15.1, upgrading to version 2.15.1 or later is likely recommended once an official fix is released. Until then, restrict namespace creation permissions to trusted users only to reduce risk.