High
Rancher: ext.cattle.io/v1 Token store: cross-user token disclosure via label-selector scoping bypass
Type: advisorySources: OSV
A flaw was found in Rancher Manager. When a non-administrative caller supplied a label selector naming a different user, the ext.cattle.io/v1 Token store dropped its internal owner filter instead of returning an empty result. Any authenticated user could therefore list and watch every other user's tokens, disclosing token metadata and the stored salted hash of the bearer token. This issue affects Rancher: before 2.15.1.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-75035
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 4 Nov 2026, 22:26 UTC · Revision 1
Source evidence
Rancher: ext.cattle.io/v1 Token store: cross-user token disclosure via label-selector scoping bypass
core-osv · Original sourcePublished 3 Sept 2026, 15:07 UTC
A flaw was found in Rancher Manager. When a non-administrative caller supplied a label selector naming a different user, the ext.cattle.io/v1 Token store dropped its internal owner filter instead of returning an empty result. Any authenticated user could therefore list and watch every other user's tokens, disclosing token metadata and the stored salted hash of the bearer token. This issue affects Rancher: before 2.15.1.
osv:CVE-2026-75035
Complete source record
{
"id": "ebe47d45f1a3498b41fff6c5e2ec8cb0ae41e04b84e1ab7ab4a5477ab709e5b9",
"url": "https://osv.dev/vulnerability/CVE-2026-75035",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Rancher: ext.cattle.io/v1 Token store: cross-user token disclosure via label-selector scoping bypass",
"summary": "A flaw was found in Rancher Manager. When a non-administrative caller supplied a label selector naming a different user, the ext.cattle.io/v1 Token store dropped its internal owner filter instead of returning an empty result. Any authenticated user could therefore list and watch every other user's tokens, disclosing token metadata and the stored salted hash of the bearer token. This issue affects Rancher: before 2.15.1.",
"evidence": "osv:CVE-2026-75035",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2026-75035",
"aliases": [
"CVE-2026-75035"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/rancher/rancher",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "8c257d748d23d4812092e28cc92b2a6f3e4dd594"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "2.15.1"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
},
{
"range": [
{
"fixed": "8c257d748d23d4812092e28cc92b2a6f3e4dd594"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v2.15.1"
},
{
"cpe": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "2.15.1"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v2.15.1-rc2",
"v2.15.1-rc1",
"v2.15.1-alpha1",
"v2.15.0",
"v2.15.0-rc5",
"v2.15.0-rc4",
"v2.15.0-rc3",
"v2.15.0-rc2",
"v2.15.0-rc1",
"v2.15.0-alpha22",
"v2.15.0-alpha19",
"v2.15.0-alpha18",
"v2.15.0-alpha17",
"v2.15.0-alpha16",
"v2.15.0-alpha15",
"v2.15.0-alpha14",
"v2.15.0-alpha13",
"v2.15.0-alpha12",
"v2.15.0-alpha11",
"v2.15.0-alpha10",
"v2.15.0-alpha9",
"v2.15.0-alpha8",
"v2.15.0-alpha7",
"v2.15.0-alpha6",
"v2.15.0-alpha5",
"v2.15.0-alpha4",
"v2.15.0-alpha3",
"v2.15.0-alpha2",
"v2.15.0-alpha1",
"v2.14.0-alpha10",
"v2.14.0-alpha9",
"v2.14.0-alpha8",
"v2.14.0-alpha7",
"v2.14.0-alpha6",
"v2.14.0-alpha5",
"v2.14.0-alpha4",
"v2.14.0-alpha3",
"v2.14.0-alpha2",
"v2.14.0-alpha1",
"v2.13.0-alpha6",
"v2.13.0-alpha5",
"v2.13.0-alpha4",
"v2.13.0-alpha3",
"v2.13.0-alpha2",
"v2.13.0-alpha1",
"v2.12.0-alpha20",
"v2.12.0-alpha19",
"v2.12.0-alpha18",
"v2.12.0-alpha17",
"v2.12.0-alpha16",
"v2.12.0-alpha15",
"v2.12.0-alpha14",
"v2.12.0-alpha13",
"v2.12.0-alpha12",
"v2.12.0-rc1",
"v2.12.0-alpha11",
"v2.12.0-alpha10",
"v2.12.0-alpha9",
"v2.12.0-alpha8",
"v2.12.0-alpha7",
"v2.12.0-alpha6",
"v2.12.0-alpha5",
"v2.12.0-alpha4",
"v2.12.0-alpha3",
"v2.12.0-alpha2",
"v2.12.0-alpha1",
"v2.12.0-hotfix-b112.1",
"v2.11.0-alpha13",
"v2.11.0-alpha12",
"v2.11.0-alpha11",
"v2.11.0-alpha10",
"v2.11.0-alpha9",
"v2.11.0-alpha8",
"v2.11.0-alpha7",
"v2.11.0-alpha6",
"v2.11.0-alpha5",
"v2.11.0-alpha4",
"v2.11.0-alpha3",
"v2.11.0-alpha2",
"v2.11.0-alpha1",
"v2.10.0-alpha10",
"v2.10.0-alpha9",
"v2.10.0-alpha8",
"v2.10.0-alpha7",
"v2.10.0-alpha6",
"v2.10.0-alpha5",
"v2.10.0-alpha4",
"v2.10.0-alpha3",
"v2.10.0-alpha2",
"v2.10.0-alpha1",
"v2.9.0-rc6",
"v2.9.0",
"v2.9.0-rc5",
"v2.9.0-rc4",
"v2.9.0-rc3",
"v2.9.0-alpha8",
"v2.9.0-rc2",
"v2.9.0-alpha7",
"v2.9.0-alpha6",
"v2.9.0-alpha5",
"v2.9.0-alpha4",
"v2.9.0-alpha3",
"v2.9.0-alpha2",
"v2.9.0-rc1",
"v2.9.0-alpha1",
"v2.7.5",
"v2.8.0-rc5",
"v2.8.0",
"v2.8.0-rc4",
"v2.8.0-rc3",
"v2.8.0-rc2",
"v2.8.0-rc1",
"v2.8.0-alpha2",
"v2.8.0-alpha1",
"v2.7.7-rc2",
"v2.7.7-rc1",
"v2.7.5-rc6",
"v2.7.5-rc5",
"v2.7.5-rc4",
"v2.7.5-rc3",
"v2.7.5-rc2",
"v2.7.5-rc1",
"v2.7.2-rc9",
"v2.7.2-rc10",
"v2.7.2",
"v2.7.2-rc8",
"v2.7.2-rc7",
"v2.7.2-rc6",
"v2.7.2-rc5",
"v2.7.2-rc4",
"v2.7.2-rc3",
"v2.7.2-rc2",
"v2.7.0-novkdm",
"v2.7.0",
"v2.7.2-rc1",
"v2.7.0-rc9",
"v2.7.0-rc12",
"v2.7.0-rc11",
"v2.7.0-rc10",
"v2.7.0-rc8",
"v2.7.0-rc7",
"v2.7.0-rc6",
"v2.7.0-rc5",
"v2.7.0-rc4",
"v2.7.0-rc3",
"v2.7.0-rc2",
"v2.7.0-rc1",
"v2.6.7-rc10",
"v2.6.7",
"v2.6.7-rc7",
"v2.6.8-rc3",
"v2.6.8-rc2",
"v2.6.7-rc9",
"v2.6.7-rc8",
"v2.6.7-rc6",
"v2.6.7-rc5",
"v2.6.7-rc4",
"v2.6.7-rc3",
"v2.6.7-rc2",
"v2.6.7-rc1",
"v2.6.5-rc12",
"v2.6.5",
"v2.6.6-rc1",
"v2.6.5-rc11",
"v2.6.5-rc10",
"v2.6.5-rc9",
"v2.6.5-rc8",
"v2.6.5-rc6",
"v2.6.5-rc5",
"v2.6.5-rc4",
"v2.6.5-rc3",
"v2.6.5-rc2",
"v2.6.4-rc11",
"v2.6.5-rc1",
"v2.6.4-rc13",
"v2.6.4-rc12",
"v2.6.4-rc10",
"v2.6.4-rc9",
"v2.6.4-rc8",
"v2.6.4-rc5",
"v2.6.4-rc6",
"v2.6.4-rc4",
"v2.6.4-rc3",
"v2.6.4-rc2",
"v2.6.4-rc1",
"v2.6.4-alpha3",
"v2.6.4-alpha2",
"v2.6.5-alpha1",
"v2.6.4-alpha1",
"v2.6.3-rc11",
"v2.6.3-harvester1",
"v2.6.3",
"v2.6.3-rc10",
"v2.6.3-rc9",
"v2.6.3-rc8",
"v2.6.3-rc7",
"v2.6.3-rc6",
"v2.6.3-rc5",
"v2.6.3-rc4",
"v2.6.3-rc3",
"v2.6.3-rc2",
"v2.6.3-rc1",
"v2.6.1-rc13",
"v2.6.1-harvester2",
"v2.6.1",
"v2.6.1-rc12",
"v2.6.1-harvester1",
"v2.6.1-rc11",
"v2.6.1-rc9",
"v2.6.1-rc10",
"v2.6.1-rc2",
"v2.6.1-rc8",
"v2.6.1-rc7",
"v2.6.1-rc6",
"v2.6.1-rc5",
"v2.6.1-rc4",
"v2.6.1-rc3",
"v2.6.1-rc1",
"v2.6.0-rc10",
"v2.6.0",
"v2.6.0-rc9",
"v2.6.0-rc8",
"v2.6.0-rc7",
"v2.6.0-rc6",
"v2.6.0-rc5",
"v2.6.0-rc4",
"v2.6.0-rc3",
"v2.6.0-rc2",
"v2.6.0-rc1",
"v2.4.0-rc9",
"v2.5.0-rc4",
"v2.5.0-rc3",
"v2.5.0-rc2",
"v2.5.0-rc1",
"v2.5.0-alpha5",
"v2.5.0-alpha4",
"v2.5.0-alpha3",
"v2.5.0-alpha2",
"v2.5.0-alpha1",
"v2.3.7-draft",
"v2.4.0-rc11",
"v2.4.0-rc10",
"v2.4.0-rc8",
"v2.4.0-rc7",
"v2.4.0-rc6",
"v2.4.0-rc5",
"v2.4.0-rc4",
"v2.4.0-rc3",
"v2.4.0-rc2",
"v2.4.0-rc1",
"v2.4.0-alpha1",
"v2.3.0-rc10",
"v2.3.0-rc9",
"v2.3.0-rc8",
"v2.3.0-rc7",
"v2.3.0-rc6",
"v2.3.0-rc5",
"v2.3.0-rc4",
"v2.3.0-rc3",
"v2.3.0-rc2",
"v2.3.0-rc1",
"v2.3.0-alpha7",
"v2.3.0-alpha6",
"v2.3.0-alpha5",
"v2.3.0-alpha4",
"v2.2.0-rc15",
"v2.2.0",
"v2.2.0-rc14",
"v2.2.0-rc13",
"v2.2.0-rc12",
"v2.2.0-rc11",
"v2.2.0-rc10",
"v2.2.0-rc9",
"v2.2.0-rc8",
"v2.2.0-rc7",
"v2.2.0-rc6",
"v2.2.0-rc5",
"v2.2.0-rc4",
"v2.2.0-rc3",
"v2.2.0-rc2",
"v2.2.0-rc1",
"v2.1.0",
"v2.1.0-rc10",
"v2.1.0-rc9",
"v2.1.0-rc8",
"v2.1.0-rc7",
"v2.1.0-rc6",
"v2.1.0-rc5",
"v2.1.0-rc4",
"v2.1.0-rc3",
"v2.1.0-rc2",
"v2.1.0-rc1",
"v2.0.8-rc2",
"v2.0.7-rc6",
"v2.0.7",
"v2.0.7-rc5",
"v2.0.7-rc4",
"v2.0.7-rc3",
"v2.0.7-rc2",
"v2.0.7-rc1",
"v2.0.6-rc2",
"v2.0.6",
"v2.0.6-rc1",
"v2.0.5",
"v2.0.5-rc6",
"v2.0.5-rc5",
"v2.0.5-rc4",
"v2.0.5-rc3",
"v2.0.5-rc2",
"v2.0.5-rc1",
"v2.0.4-rc1",
"v2.0.4",
"v2.0.3-rc5",
"v2.0.3",
"v2.0.3-rc4",
"v2.0.3-rc3",
"v2.0.3-rc2",
"v2.0.3-rc1",
"v2.0.2-rc1",
"v2.0.2",
"v2.0.1",
"v2.0.1-rc6",
"v2.0.1-rc5",
"v2.0.1-rc4",
"v2.0.1-rc3",
"v2.0.1-rc2",
"v2.0.1-rc1",
"v2.0.0-rc5",
"v2.0.0",
"v2.0.0-rc4",
"v2.0.0-rc3",
"v2.0.0-rc2",
"v2.0.0-rc1",
"v2.0.0-beta4-rc4",
"v2.0.0-beta4",
"v2.0.0-beta4-rc3",
"v2.0.0-beta4-rc2",
"v2.0.0-beta4-rc1",
"v2.0.0-beta3-rc1",
"v2.0.0-beta3",
"v2.0.0-beta2",
"v2.0.0-beta1",
"v2.0.0-alpha28",
"v2.0.0-alpha27",
"v2.0.0-alpha26",
"v2.0.0-alpha25",
"v2.0.0-alpha24",
"v2.0.0-alpha22",
"v2.0.0-alpha23",
"v2.0.0-alpha21",
"v2.0.0-alpha20",
"v2.0.0-alpha19",
"v2.0.0-alpha18",
"v2.0.0-alpha17",
"v2.0.0-alpha14",
"v2.0.0-alpha12",
"v2.0.0-alpha11"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-75035.json"
}
}
],
"modified": "2026-10-28T02:30:39.881063770Z",
"provider": "osv",
"references": [
"https://github.com/rancher/rancher/releases/tag/v2.15.1",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/75xxx/CVE-2026-75035.json",
"https://nvd.nist.gov/vuln/detail/CVE-2026-75035",
"https://github.com/rancher/rancher"
],
"provider_metadata": {
"cwe_ids": [
"CWE-639"
],
"cna_assigner": "suse",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/75xxx/CVE-2026-75035.json"
}
},
"related_cves": [
{
"value": "CVE-2026-75035",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 507608,
"published_at": "2026-09-03T15:07:11.685+00:00"
}