Rancher v2.15.1 Security Release: 6 CVE fixes

Rancher v2.15.1 Security Update Summary Vulnerability Overview Rancher v2.15.1 is a community-maintained release that primarily includes maintenance updates and bug fixes, with a focus on remediating multiple security vulnerabilities. Scope of Impact and Fix Details 1. SAML Authentication Replay Attack (CVE-2026-76334) Issue: In high-availability (multi-replica) deployments, the replay protection for the SAML authentication handler fails. Attackers can replay assertions from different projects, thereby gaining access to unauthorized projects. Fix: The replay protection mechanism in the SAML authentication handler has been fixed. 2. Unauthenticated API Project Object Leak (CVE-2026-76333) Issue: Unauthenticated users can access project objects via the API, leading to the leakage of sensitive information (such as Project Secrets). Fix: Access control for unauthenticated API project objects has been fixed. 3. Cluster Reference Extension Token Leak (CVE-2026-75205) Issue: The Cluster Reference Extension Token API allows unauthenticated users to list and view other users' tokens. Fix: Token listing and viewing permissions have been fixed to restrict access to only the token owner and cluster administrators. 4. User Role Privilege Escalation (CVE-2026-71240) Issue: The field in user roles can be overwritten with arbitrary values, resulting in privilege escalation. Fix: The validation logic for the field has been fixed. 5. Tampering with User Identity Fields (CVE-2026-71403) Issue: User identity fields (such as , , and ) can be modified via POST requests, leading to identity tampering. Fix: The API and Webhook layers have been updated to reject POST modifications to these identity fields. 6. Fleet Helm Template Preprocessing Network Access (CVE-2026-75236) Issue: During the Helm template preprocessing phase of the Fleet controller, users can access network resources via directives such as within templates, leading to information leakage or unintended network requests. Fix: Network access controls in Helm template preprocessing have been fixed. Remediation Upgrading to Rancher v2.15.1 remediates all of the above vulnerabilities. For the SAML replay attack, it is recommended to also update the Relaying Party Trust certificate for AD FS (add the certificate via the "Properties" → "Signing" tab). Other Notable Changes K3s and RKE2 Provisioning: Fixed an issue where unused orphan infrastructure resources (such as CAPA or CAPV1) left behind when creating or editing v2prov clusters required manual cleanup. Image Artifacts: The image digest files for Rancher v2.15.1 have been updated; the digest files for Linux and Windows have been renamed. Upgrade Requirements: - A backup must be created prior to upgrading. - Supports Kubernetes version 1.33. - For K3s environments, the namespace must be created manually. - For RKE2 environments, the namespace must be created manually. Known Issues Rancher General: In Rancher v2.15.0 and Kubernetes v1.36 clusters, Rancher Backups are not listed under Cluster Tools. Cluster Provisioning: Non-all cluster tools cannot be installed on bare-metal clusters. RKE2 Provisioning: In Rancher v2.7.0, backup logs indicate that component downloads and RKE2 cluster migrations take a long time. K3s Provisioning: In Rancher v2.7.0, adding a non-built-in custom driver when provisioning RKE2/K3s clusters causes the provisioning to fail. Rancher App (Global UI): In Rancher v2.10.0, after deleting a Namespace or Project in the Rancher UI, the Namespace or Project remains visible. Authentication: In Rancher v2.0, when a generic OIDC identity provider is enabled, attempting to add an identity provider user to a cluster or project results in the user not being correctly populated in the dropdown. Webhook: In Rancher v2.7.0, if the Webhook is installed in a downstream cluster and the Rancher version is earlier than v2.7.2, the Webhook will not function correctly. Virtualization Management (Harvester): In Rancher v2.13.1, when using Harvester v1.1.1, Load Balancers do not work properly in downstream clusters. Backup/Restore: In Rancher v2.13.0, when using Rancher v2.13.0 or later, backup and restore operations fail to complete successfully.

Goal Reached Thanks to every supporter — we hit 100%!

Rancher v2.15.1 Security Release: 6 CVE fixes

More from this source