CVE-2026-75033

Name of the Vulnerable Software and Affected Versions Rancher versions prior to 2.15.1

Description A flaw in Rancher Manager allows Project Secrets to be propagated into a namespace based solely on the field.cattle.io/projectId annotation. The system fails to verify if the referenced project belongs to the same downstream cluster. Consequently, a user with permissions to create namespaces on one cluster can set the annotation to a project ID from a different cluster, causing that project's secrets to be copied into a namespace under their control.

Recommendations Update to version 2.15.1 or later.