{"id":"CVE-2026-75033","aliases":["EUVD-2026-70506"],"status":"published","title":"Rancher: Cross-Cluster Secret Leakage via Namespace projectId Annotation Spoofing","description":"A flaw was found in Rancher Manager. Project Secrets were propagated into a namespace based only on its `field.cattle.io/projectId` annotation, without verifying that the referenced project belonged to the same downstream cluster. A user able to create namespaces on one cluster could set the annotation to a project ID from another cluster and have that project's secrets copied into a namespace under their control.\n\n\nThis issue affects Rancher: before 2.15.1.","severity":{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.0034,"percentile":0.2789,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-639"],"published":"2026-09-03T14:57:34Z","modified":"2026-10-28T02:30:36Z","products":[{"vendor":"suse","product":"rancher"}],"references":[{"url":"https://github.com/rancher/rancher/releases/tag/v2.15.1","tags":["Release Notes","web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/75xxx/CVE-2026-75033.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75033","tags":["advisory"]},{"url":"https://github.com/rancher/rancher","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-75033","title":"Rancher: Cross-Cluster Secret Leakage via Namespace projectId Annotation Spoofing","description":"A flaw was found in Rancher Manager. Project Secrets were propagated into a namespace based only on its `field.cattle.io/projectId` annotation, without verifying that the referenced project belonged to the same downstream cluster. A user able to create namespaces on one cluster could set the annotation to a project ID from another cluster and have that project's secrets copied into a namespace under their control.\n\n\nThis issue affects Rancher: before 2.15.1.","status":"published","published":"2026-09-03T14:57:34.334Z","modified":"2026-09-03T15:13:54.624Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:20:07.260654Z"}],"euvd":[{"id":"EUVD-2026-70506","description":"A flaw was found in Rancher Manager. Project Secrets were propagated into a namespace based only on its `field.cattle.io/projectId` annotation, without verifying that the referenced project belonged to the same downstream cluster. A user able to create namespaces on one cluster could set the annotation to a project ID from another cluster and have that project's secrets copied into a namespace under their control.\n\n\nThis issue affects Rancher: before 2.15.1.","status":"published","published":"2026-09-03T14:57:34Z","modified":"2026-09-03T15:13:54Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T18:01:13.671159Z"}],"nvd":[{"id":"CVE-2026-75033","description":"A flaw was found in Rancher Manager. Project Secrets were propagated into a namespace based only on its `field.cattle.io/projectId` annotation, without verifying that the referenced project belonged to the same downstream cluster. A user able to create namespaces on one cluster could set the annotation to a project ID from another cluster and have that project's secrets copied into a namespace under their control.\n\n\nThis issue affects Rancher: before 2.15.1.","status":"published","published":"2026-09-03T15:17:32.873Z","modified":"2026-09-18T14:56:19.56Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:12:43.399612Z"}],"osv":[{"id":"CVE-2026-75033","title":"Rancher: Cross-Cluster Secret Leakage via Namespace projectId Annotation Spoofing","description":"A flaw was found in Rancher Manager. Project Secrets were propagated into a namespace based only on its `field.cattle.io/projectId` annotation, without verifying that the referenced project belonged to the same downstream cluster. A user able to create namespaces on one cluster could set the annotation to a project ID from another cluster and have that project's secrets copied into a namespace under their control.\n\n\nThis issue affects Rancher: before 2.15.1.","status":"published","published":"2026-09-03T14:57:34.334Z","modified":"2026-10-28T02:30:36.348362331Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T15:45:16.748692Z"}]}}