CVE-2026-71403 in Rancher
Summary
by MITRE • 09/03/2026
A flaw was found in Rancher Manager. The /v3/users update path did not enforce immutability of a User resource's `username` and `principalIds` fields. A user holding the `update` verb on `users.management.cattle.io` could inject a foreign identity provider principal into any account, so that the next login by the owner of that principal was bound to the victim's account and inherited its role bindings.
This issue affects Rancher: before 2.15.1.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/03/2026
The vulnerability identified in Rancher Manager represents a critical authentication bypass mechanism rooted in improper access control logic within the user management subsystem. Specifically, the flaw resides in the /v3/users update endpoint, which fails to enforce immutability constraints on two fundamental fields of the User resource: username and principalIds. In secure identity management systems, these attributes are typically treated as immutable identifiers that bind a specific external identity provider account to an internal user profile. By allowing these fields to be modified after initial creation, the system permits administrators or users with sufficient privileges to alter the association between an existing local Rancher account and arbitrary external identities. This design oversight creates a pathway for privilege escalation through identity injection rather than traditional credential compromise.
The operational impact of this flaw is severe because it allows any user possessing the update verb on users.management.cattle.io resources to inject foreign identity provider principals into other accounts. When an attacker modifies the principalIds field of a target victim's account, they effectively link their own external identity credentials to that victim profile. Consequently, when the owner of the injected principal logs in using their legitimate external credentials, the system authenticates them as the victim user. This results in immediate inheritance of all role bindings and permissions associated with the victim's account. The attacker gains access without needing to guess passwords or exploit weak authentication mechanisms on the target side, effectively bypassing multi-factor authentication if it is tied to the identity provider rather than the local Rancher session state.
From a classification perspective, this vulnerability aligns closely with CWE-284 Improper Access Control and CWE-613 Insufficient Session Expiration or Termination in terms of its impact on session integrity. The core issue is a failure to validate that modifications to identity mappings are authorized for the specific target resource, which also relates to CWE-798 Use of Hard-coded Credentials if interpreted as unauthorized credential binding. In the context of the MITRE ATT&CK framework, this behavior maps directly to T1078 Valid Accounts and specifically T1136 Create Account, where an adversary creates or modifies accounts to maintain persistence or escalate privileges. The technique involves manipulating identity attributes to impersonate other users, which falls under lateral movement techniques that rely on trusted relationships within the authentication infrastructure.
Mitigation strategies must prioritize immediate patching of the Rancher Manager software to version 2.15.1 or later, where these immutability constraints have been enforced at the API level. Until patches are applied, administrators should strictly limit who holds the update verb on users.management.cattle.io resources, restricting this privilege only to high-level cluster admins who require it for legitimate operational tasks. Additionally, implementing strict audit logging and monitoring for changes to principalIds fields can help detect unauthorized injection attempts in real-time. Organizations should also review their identity provider configurations to ensure that session tokens are bound tightly to the initial authentication context, although the primary fix must occur at the application layer where the validation logic resides. Regular security assessments of role-based access control policies within Rancher environments are essential to prevent similar privilege escalation vectors from being exploited by malicious insiders or compromised low-privilege accounts.