Is CVE-2026-75033 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-75033 being exploited in the wild.

How severe is CVE-2026-75033?

High severity, with a CVSS score of 7.7, published 3 September 2026.

Which products and versions are affected?

Rancher Rancher Manager before 2.15.1.

Is there a fix for CVE-2026-75033?

A patch was published on 2026-08-28: Fix released in Rancher v2.15.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-75033 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-75033?

Check whether you run Suse Rancher. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-75033: Rancher Manager secret propagation bypass via namespace annotation

CVE-2026-75033 · Severity: high · CVSS 7.7 · Published 2026-09-03

Rancher Manager is an open-source container management platform that centralizes cluster administration and secret management across Kubernetes deployments. A flaw in the project-scoped secrets controller allowed an authenticated user with namespace creation permissions on one cluster to spoof annotations and copy secrets from a different cluster's projects, potentially exposing sensitive credentials and authentication material. An attacker could leverage this to gain unauthorized access to secrets belonging to other projects and clusters.

Technologies: Suse Rancher. Vendors: Suse.

Quick answers

Is CVE-2026-75033 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-75033 being exploited in the wild.
How severe is CVE-2026-75033?: High severity, with a CVSS score of 7.7, published 3 September 2026.
Which products and versions are affected?: Rancher Rancher Manager before 2.15.1.
Is there a fix for CVE-2026-75033?: A patch was published on 2026-08-28: Fix released in Rancher v2.15.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-75033 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-75033?: Check whether you run Suse Rancher. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in Rancher's project-scoped secretsController, which propagates Project Secrets into namespaces based on the `field.cattle.io/projectId` annotation without validating that the referenced project belongs to the same downstream cluster. The root cause is insufficient authorization checks during secret propagation—the controller trusts the annotation value without cross-referencing cluster ownership. An authenticated user with namespace creation permissions on one downstream cluster can craft a malicious annotation pointing to a project ID from a different cluster, causing the controller to copy that project's secrets into a namespace under their control. The fix validates that the referenced project resides within the same cluster before propagating secrets. This issue requires valid cluster authentication but no elevated privileges beyond namespace creation capability.

Affected products

Rancher Rancher Manager before 2.15.1

Timeline

2026-09-03: disclosed
2026-08-28: patched: Fix released in Rancher v2.15.1

References

https://github.com/rancher/rancher/releases/tag/v2.15.1

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.