CVE-2026-75035

Name of the Vulnerable Software and Affected Versions Rancher versions prior to 2.15.1

Description A flaw in Rancher Manager allows an authenticated non-administrative user to list and watch tokens belonging to other users. This occurs when a label selector naming a different user is supplied, causing the 'ext.cattle.io/v1' Token store to drop its internal owner filter instead of returning an empty result. This leads to the disclosure of token metadata and the stored salted hash of the bearer token.

Recommendations Update to version 2.15.1 or later.