CVE-2026-75035

A flaw was found in Rancher Manager. When a non-administrative caller supplied a label selector naming a different user, the ext.cattle.io/v1 Token store dropped its internal owner filter instead of returning an empty result. Any authenticated user could therefore list and watch every other user's tokens, disclosing token metadata and the stored salted hash of the bearer token. This issue affects Rancher: before 2.15.1.

• CWE-639

• https://github.com/rancher/rancher/releases/tag/v2.15.1Release Notes

Published

Sep 3, 2026

Last Modified

Sep 18, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-7503A vulnerability was detected in code-projects for Plugin 4.1…8.8
• CVE-2026-75030Missing Authorization vulnerability in Apache Syncope. An…9.8
• CVE-2026-75031In the interchange/interchange project, a critical remote co…9.8
• CVE-2026-75032A flaw was found in BlueZ. Insufficient validation of packet…6.3
• CVE-2026-75033A flaw was found in Rancher Manager. Project Secrets were pr…7.7
• CVE-2026-75034A flaw was found in Rancher Manager. The SAML assertion repl…7.4
• CVE-2026-75036A security vulnerability was discovered in Fleet's Helm temp…5.3
• CVE-2026-75037Polkit Authentication Based on UnixProcessSubject / Peer PID…7
• CVE-2026-75038UNIX symbolic link (symlink) following vulnerability in ilya…6.1
• CVE-2026-7504A flaw was found in Keycloak's URL validation logic during r…8.1
• CVE-2026-75044In JetBrains YouTrack before 2025.3.156085, 2026.1.13914, …8.1
• CVE-2026-75045In JetBrains YouTrack before 2025.3.156085, 2026.1.13913, …9.1