Executive brief
Rancher Manager is an open-source container management platform that centralizes cluster administration and secret management across Kubernetes deployments. A flaw in the project-scoped secrets controller allowed an authenticated user with namespace creation permissions on one cluster to spoof annotations and copy secrets from a different cluster's projects, potentially exposing sensitive credentials and authentication material. An attacker could leverage this to gain unauthorized access to secrets belonging to other projects and clusters.
Technical details
The vulnerability exists in Rancher's project-scoped secretsController, which propagates Project Secrets into namespaces based on the `field.cattle.io/projectId` annotation without validating that the referenced project belongs to the same downstream cluster. The root cause is insufficient authorization checks during secret propagation—the controller trusts the annotation value without cross-referencing cluster ownership. An authenticated user with namespace creation permissions on one downstream cluster can craft a malicious annotation pointing to a project ID from a different cluster, causing the controller to copy that project's secrets into a namespace under their control. The fix validates that the referenced project resides within the same cluster before propagating secrets. This issue requires valid cluster authentication but no elevated privileges beyond namespace creation capability.
Affected products
- Rancher Rancher Manager before 2.15.1
Timeline
- 2026-09-03: disclosed
- 2026-08-28: patched: Fix released in Rancher v2.15.1