The flaw is an authorization bypass that allows a user who can create namespaces on a cluster to set the field.cattle.io/projectId annotation to a project ID belonging to another cluster. Because Rancher Manager copies the project’s secrets into the namespace without verifying that the referenced project is in the same downstream cluster, the actor gains access to secrets that are not intended for their cluster, resulting in unintended disclosure of confidential data and potential lateral movement or privilege escalation. This weakness is identified as CWE‑639 (Authorization Bypass Through User‑Controlled Key).

All systems running Rancher Manager versions prior to 2.15.1 are vulnerable. The issue affects the namespace creation and secret propagation logic in Rancher, specifically for SUSE Rancher deployments. The vulnerability becomes active whenever a user with permission to create namespaces can manipulate the projectId annotation, which is possible in all Rancher releases before the fix.

The CVSS score of 7.7 indicates high severity. Exploitation requires the ability to create namespaces, a privilege typically granted to cluster administrators or users with elevated rights; no special network distance or software execution is needed beyond the normal Rancher API. The EPSS score is not available, but the lack of a KEV listing does not reduce the potential for exploitation. Given the straightforward attack path and the sensitive nature of the leaked secrets, the risk to organizations with exposed cluster administrator privileges is high and should be treated as an immediate threat.