CVE-2026-75033— Rancher: Cross-Cluster Secret Leakage via Namespace projectId Annotation Spoofing
Quick assessment
Affected
SUSE Rancher
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
以下是该漏洞描述的中文翻译： Rancher Manager 中存在一个缺陷：项目密钥（Project Secrets）仅根据命名空间的 注解进行传播，而未验证所引用的项目是否属于同一个下游集群。因此，一个能够创建命名空间的用户可以将注解设置为来自另一个集群的项目 ID，从而将该项目下的密钥复制到该用户所控制的命名空间中。 此问题影响 Rancher 2.15.1 之前的版本。
Possible ATT&CK Techniques 1 AI
T1078 · Valid Accounts
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-75033
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Rancher: Cross-Cluster Secret Leakage via Namespace projectId Annotation Spoofing
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in Rancher Manager. Project Secrets were propagated into a namespace based only on its `field.cattle.io/projectId` annotation, without verifying that the referenced project belonged to the same downstream cluster. A user able to create namespaces on one cluster could set the annotation to a project ID from another cluster and have that project's secrets copied into a namespace under their control.
This issue affects Rancher: before 2.15.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-75033
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-75033
请登录查看更多情报信息。
Vendor Pages for CVE-2026-75033 (1)
Same Patch Batch · SUSE · 2026-09-03 · 6 CVEs total
| CVE-2026-71404 | 8.7 HIGH | Rancher: Ownership-less ClusterRole overwrite via attacker-controlled cr-name annotation o |
| CVE-2026-75035 | 7.7 HIGH | Rancher: ext.cattle.io/v1 Token store: cross-user token disclosure via label-selector scop |
| CVE-2026-75034 | 7.4 HIGH | Rancher: SAML Assertion Replay |
| CVE-2026-71403 | 6.1 MEDIUM | Rancher: Identity-field mutation in /v3/users allows account hijack via principal rebind |
| CVE-2026-75036 | 5.3 MEDIUM | Fleet: DNS exfiltration via Sprig getHostByName in fleet.yaml Helm template preprocessing |
IV. Related Vulnerabilities
Same product: Rancher
-
CVE-2026-75035
Rancher: ext.cattle.io/v1 Token store: cross-user token disc -
CVE-2026-75034
Rancher: SAML Assertion Replay -
CVE-2026-71404
Rancher: Ownership-less ClusterRole overwrite via attacker-c -
CVE-2026-71403
Rancher: Identity-field mutation in /v3/users allows account -
CVE-2026-44945
Cross-Cluster Impersonation Confused-Deputy Privilege Escala
Same vendor: SUSE
-
CVE-2026-75036
Fleet: DNS exfiltration via Sprig getHostByName in fleet.yam -
CVE-2026-75035
Rancher: ext.cattle.io/v1 Token store: cross-user token disc -
CVE-2026-75034
Rancher: SAML Assertion Replay -
CVE-2026-71404
Rancher: Ownership-less ClusterRole overwrite via attacker-c -
CVE-2026-71403
Rancher: Identity-field mutation in /v3/users allows account
Same weakness: CWE-639
-
CVE-2026-85381
light0011 cms Chapter Controller ChapterController.class.php -
CVE-2026-85378
light0011 cms Chapter Controller ChapterController.class.php -
CVE-2026-69857
Azure Cosmos DB Spoofing Vulnerability -
CVE-2026-83711
Microsoft Azure Active Directory B2C Elevation of Privilege -
CVE-2026-85392
Peppermint through 0.5.5 Authorization Bypass on the User Lo
V. Comments for CVE-2026-75033
No comments yet