# CVE-2026-75035: Rancher Manager access control bypass in Token API

Source: https://junglewise.ai/threats/cve-2026-75035-rancher-manager-access-control-bypass-in-token-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-75035 · Severity: high · CVSS 7.7 · Published 2026-09-03

Rancher Manager is a platform for managing Kubernetes clusters across an organization. A flaw in its token management system allowed any authenticated user to view other users' API tokens, including the cryptographic hash of the bearer token itself. An attacker with any valid credentials could exploit this to steal or impersonate other users' service accounts, potentially gaining unauthorized access to cluster resources.

Technologies: [Suse Rancher](https://junglewise.ai/threats/technologies/rancher), [Suse Rancher Manager](https://junglewise.ai/threats/technologies/rancher-manager). Vendors: [Suse](https://junglewise.ai/threats/vendors/suse).

## Quick answers

**Is CVE-2026-75035 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-75035 being exploited in the wild.

**How severe is CVE-2026-75035?** High severity, with a CVSS score of 7.7, published 3 September 2026.

**Which products and versions are affected?** Suse Rancher Manager before 2.15.1.

**Is there a fix for CVE-2026-75035?** A patch was published on 2026-08-28: Fix included in v2.15.1 release Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-75035 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-75035?** Check whether you run Suse Rancher or Suse Rancher Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an access control bypass in the ext.cattle.io/v1 Token API store. When a non-administrative user supplied a label selector targeting a different user, the internal owner filter was incorrectly dropped instead of returning an empty result, allowing the listing and watching of all tokens across all users. The flaw affects the imperative Token API and allows authenticated attackers to disclose token metadata and the stored salted hash of bearer tokens. The fix enforces per-user scoping unconditionally at the store level and removes the token hash from read responses. The vulnerability was patched in Rancher v2.15.1.

## Affected products

- SUSE Rancher Manager before 2.15.1

## Timeline

- 2026-09-03: disclosed
- 2026-08-28: patched: Fix included in v2.15.1 release

## References

- [https://github.com/rancher/rancher/releases/tag/v2.15.1](https://github.com/rancher/rancher/releases/tag/v2.15.1)

## Related threats

- [SUSE Rancher Manager credential leak in meta proxy](https://junglewise.ai/threats/cve-2026-88811-missing-filtering-in-the-suse-rancher-manager-meta-proxy-could)
- [SUSE Rancher privilege escalation in GlobalRole RBAC](https://junglewise.ai/threats/cve-2026-88810-a-privilege-escalation-issue-was-discovered-in-rancher-manager-s)
- [SUSE Rancher Manager meta proxy allowlist bypass leading to SSRF](https://junglewise.ai/threats/cve-2026-88809-a-security-vulnerability-exists-in-the-suse-rancher-manager-meta)
- [SUSE Rancher Manager authorization bypass in local cluster shell](https://junglewise.ai/threats/cve-2026-104623-a-security-vulnerability-exists-in-the-authorization-handling)
- [Rancher privilege escalation via project name collision](https://junglewise.ai/threats/cve-2024-22031-rancher-users-who-can-create-projects-can-gain-access-to)