CVE-2026-71403: Rancher: Identity-field mutation in /v3/users allows account hijack via principal rebind
A flaw was found in Rancher Manager. The /v3/users update path did not enforce immutability of a User resource's username and principalIds fields. A user holding the update verb on users.management.cattle.io could inject a foreign identity provider principal into any account, so that the next login by the owner of that principal was bound to the victim's account and inherited its role bindings.
This issue affects Rancher: before 2.15.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Rancherto a version that resolves this vulnerability.Fixed in 2.15.1
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs permission to update User resources through the users.management.cattle.io API. The required permission is the update verb on that resource, and exploitation also requires user interaction in the form of the identity principal owner logging in afterward.
What accounts are at risk?
Any account whose User resource can be modified by a principal with update access to users.management.cattle.io is at risk. The attacker can add a foreign identity-provider principal, causing that principal's owner to be associated with the targeted account on their next login and inherit its role bindings.
Which versions are affected?
Rancher Manager versions before 2.15.1 are affected.
What can be done until upgrading?
Restrict the update verb on users.management.cattle.io to only trusted administrators, and review who currently has that permission. This reduces the ability to alter username or principalIds fields on User resources.