THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-75035 (HIGH 7.7) — A flaw was found in Rancher Manager. When a non-administrative caller supplied a label selector naming a different user, the ext.cattle.io/v1 Token store dropped its internal owner filter instead of returning an empty result. Any authenticated user could therefore list and watch

[NVD] CVE-2026-75035 (HIGH 7.7) — A flaw was found in Rancher Manager. When a non-administrative caller supplied a label selector naming a different user, the ext.cattle.io/v1 Token store dropped its internal owner filter instead of returning an empty result. Any authenticated user could therefore list and watch

mednvdPublished 2026-09-03

CVE-2026-75035 CVSS: 7.7 HIGH Published: 2026-09-03T16:18:22.477

A flaw was found in Rancher Manager. When a non-administrative caller supplied a label selector naming a different user, the ext.cattle.io/v1 Token store dropped its internal owner filter instead of returning an empty result. Any authenticated user could therefore list and watch every other user's tokens, disclosing token metadata a

Indicators of compromise

CVE-2026-75035cve
ext.cattle.iodomain

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-75035