Token Exposure Vulnerability in Rancher Manager by Rancher

CVE-2026-75035

What is CVE-2026-75035?

A vulnerability exists in Rancher Manager that allows authenticated users to inadvertently access and list tokens belonging to other users. When a non-administrative user specifies a label selector for a different user's token, the expected behavior of filtering results is compromised. Instead of blocking access, the internal filter on the token store is dropped, leading to the potential disclosure of sensitive token metadata and the salted hash of bearer tokens. This issue impacts all versions of Rancher Manager prior to 2.15.1, necessitating immediate action for users to update their installations.

References