Quick answers
- Is CVE-2026-75035 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-75035 being exploited in the wild.
- How severe is CVE-2026-75035?
- High severity, with a CVSS score of 7.7, published 3 September 2026.
- Which products and versions are affected?
- Suse Rancher Manager before 2.15.1.
- Is there a fix for CVE-2026-75035?
- A patch was published on 2026-08-28: Fix included in v2.15.1 release Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-75035 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-75035?
- Check whether you run Suse Rancher or Suse Rancher Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an access control bypass in the ext.cattle.io/v1 Token API store. When a non-administrative user supplied a label selector targeting a different user, the internal owner filter was incorrectly dropped instead of returning an empty result, allowing the listing and watching of all tokens across all users. The flaw affects the imperative Token API and allows authenticated attackers to disclose token metadata and the stored salted hash of bearer tokens. The fix enforces per-user scoping unconditionally at the store level and removes the token hash from read responses. The vulnerability was patched in Rancher v2.15.1.
Affected products
- SUSE Rancher Manager before 2.15.1
Timeline
- 2026-09-03: disclosed
- 2026-08-28: patched: Fix included in v2.15.1 release