Executive brief
Rancher Manager is a Kubernetes cluster management platform used by organizations to centralize control and governance of multiple clusters. A flaw in the user update API allowed administrators with user modification permissions to inject foreign identity provider credentials into any user account. When the victim logs in with that identity provider, their session becomes bound to the compromised account, granting the attacker inherited access rights and role-based permissions without the victim's knowledge.
Technical details
The vulnerability exists in Rancher's /v3/users REST API endpoint, which failed to enforce immutability constraints on the `username` and `principalIds` fields during user resource updates. An attacker with the `update` verb permission on `users.management.cattle.io` could modify a target user's account by injecting a principal identifier (identity provider credential) they control. When the legitimate owner of that principal logs in via federated authentication, the identity binding mechanism routes their session to the attacker's target account instead of creating a new account, allowing the attacker to impersonate the victim and inherit all role bindings. The fix, merged in August 2026, properly validates and enforces field immutability on the update path.
Affected products
- Rancher Labs Rancher Manager before 2.15.1
Timeline
- 2026-09-03: disclosed
- 2026-08-14: patched: Fix merged in PR #56616 for v2.15