Description

A flaw was found in Rancher Manager. The /v3/users update path did not enforce immutability of a User resource's `username` and `principalIds` fields. A user holding the `update` verb on `users.management.cattle.io` could inject a foreign identity provider principal into any account, so that the next login by the owner of that principal was bound to the victim's account and inherited its role bindings. This issue affects Rancher: before 2.15.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-09-03T15:17:32.180Z",
  "pubdate": "2026-09-03T15:17:32.180Z",
  "executiveSummary": "This vulnerability is an improper access control flaw identified in the Rancher Manager /v3/users update path. It allows a user possessing the 'update' verb for the 'users.management.cattle.io' resource to perform identity injection.\nBy failing to enforce the immutability of 'username' and 'principalIds' fields, an attacker can associate a foreign identity provider principal with a victim's user account.\nThis facilitates a critical privilege escalation and account takeover scenario. Upon the next login event, the legitimate owner of the injected identity is authenticated into the victim's account, thereby inheriting all role bindings and permissions associated with the compromised user resource.\nThe vulnerability affects all versions of Rancher prior to 2.15.1. Successful exploitation requires an attacker to already possess sufficient privileges to update user resources within the management API.\nThe risk is severe as it enables unauthorized access to administrative sessions and persistent account manipulation.",
  "technicalDetails": "The root cause of this vulnerability lies in the insufficient input validation and lack of immutability enforcement on critical identity fields within the /v3/users API endpoint in Rancher Manager.\nThe 'users.management.cattle.io' resource, which defines user identity and access within the Rancher management plane, relies on 'username' and 'principalIds' to establish unique identity mappings.\nBecause the update mechanism fails to verify or restrict modifications to these fields, an authenticated actor with 'update' permissions can alter the 'principalIds' array of an existing user object.\nThe attack flow proceeds as follows: First, the attacker identifies a target user resource and initiates a PUT or PATCH request to the /v3/users endpoint. Second, the attacker injects an identity string (principalId) under their control or associated with an unsuspecting third party into the target's 'principalIds' field.\nThird, the Rancher authentication backend, which performs identity provider (IdP) lookups based on these identifiers, creates a binding between the newly injected principal and the victim account. Finally, when the owner of the injected principal attempts to log in via the identity provider, the system authenticates them into the victim’s account context.\nThis results in the victim's account assuming the privileges of the authenticated user, or conversely, granting the attacker access to all roles and permissions assigned to the target account. Because Rancher role bindings are persistent, the compromised account maintains these permissions until the administrator manually intervenes to revert the 'principalIds' configuration.\nThe vulnerability is present in the management plane of Rancher, specifically within the user management resource controller. It does not require network exposure beyond access to the Rancher API. The exploitation is strictly limited to authenticated users with existing 'update' verb privileges for the user management resource, rendering this a privilege escalation vulnerability targeting the account management logic of the platform."
}