# CVE-2026-71403: Rancher Manager privilege escalation via user identity injection

Source: https://junglewise.ai/threats/cve-2026-71403-rancher-manager-privilege-escalation-via-user-identity-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-71403 · Severity: medium · CVSS 6.1 · Published 2026-09-03

Rancher Manager is a Kubernetes cluster management platform used by organizations to centralize control and governance of multiple clusters. A flaw in the user update API allowed administrators with user modification permissions to inject foreign identity provider credentials into any user account. When the victim logs in with that identity provider, their session becomes bound to the compromised account, granting the attacker inherited access rights and role-based permissions without the victim's knowledge.

Technologies: [Suse Rancher](https://junglewise.ai/threats/technologies/rancher). Vendors: [Suse](https://junglewise.ai/threats/vendors/suse).

## Quick answers

**Is CVE-2026-71403 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-71403 being exploited in the wild.

**How severe is CVE-2026-71403?** Medium severity, with a CVSS score of 6.1, published 3 September 2026.

**Which products and versions are affected?** Rancher Labs Rancher Manager before 2.15.1.

**Is there a fix for CVE-2026-71403?** A patch was published on 2026-08-14: Fix merged in PR #56616 for v2.15 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-71403 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-71403?** Check whether you run Suse Rancher. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in Rancher's /v3/users REST API endpoint, which failed to enforce immutability constraints on the `username` and `principalIds` fields during user resource updates. An attacker with the `update` verb permission on `users.management.cattle.io` could modify a target user's account by injecting a principal identifier (identity provider credential) they control. When the legitimate owner of that principal logs in via federated authentication, the identity binding mechanism routes their session to the attacker's target account instead of creating a new account, allowing the attacker to impersonate the victim and inherit all role bindings. The fix, merged in August 2026, properly validates and enforces field immutability on the update path.

## Affected products

- Rancher Labs Rancher Manager before 2.15.1

## Timeline

- 2026-09-03: disclosed
- 2026-08-14: patched: Fix merged in PR #56616 for v2.15

## References

- [https://github.com/rancher/rancher/pull/56616](https://github.com/rancher/rancher/pull/56616)

## Related threats

- [SUSE Rancher privilege escalation in GlobalRole RBAC](https://junglewise.ai/threats/cve-2026-88810-a-privilege-escalation-issue-was-discovered-in-rancher-manager-s)
- [Rancher privilege escalation via project name collision](https://junglewise.ai/threats/cve-2024-22031-rancher-users-who-can-create-projects-can-gain-access-to)
- [SUSE Rancher Fleet privilege escalation in resource deployment](https://junglewise.ai/threats/cve-2026-88808-a-vulnerability-has-been-identified-within-rancher-manager-where)
- [SUSE Rancher session revocation bypass on logout](https://junglewise.ai/threats/cve-2026-88805-incorrect-credential-cleaning-on-logout-could-be-used-by-remote)
- [SUSE Rancher stored cross-site scripting in public UI settings](https://junglewise.ai/threats/cve-2026-88804-an-unauthenticated-update-of-public-ui-settings-could-be-used-by)