CVE-2026-75035: CWE-639 Authorization bypass through User-Controlled key in SUSE Rancher

The vulnerability in Rancher Manager occurs when a non-administrative user supplies a label selector naming a different user. Instead of enforcing an internal owner filter, the ext.cattle.io/v1 Token store drops this filter and returns tokens belonging to other users. This flaw enables unauthorized access to token metadata and the stored salted hash of bearer tokens, potentially facilitating further attacks. The issue affects Rancher versions prior to 2.15.1.

Any authenticated user with non-administrative privileges can bypass authorization controls to enumerate and observe tokens of other users. This exposure includes sensitive token metadata and salted hashes of bearer tokens, which could be leveraged to compromise user sessions or escalate privileges. The vulnerability does not impact availability or integrity but has a high confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the affected versions are prior to 2.15.1, upgrading to version 2.15.1 or later is likely recommended once a fix is available. Until then, restrict access to Rancher Manager to trusted users and monitor for suspicious activity related to token access.