CVE-2026-44936
published 2026-07-06CVE-2026-44936: Missing filtering when the helmRepoURLRegex field isn't set on a GitRepo resource in SUSE Rancher Fleet's bundle reader in 0.15 before 0.15.2, 0.14 before…
PriorityP432medium5CVSS 3.1
AVNACLPRLUINSCCLINAN
EPSS
0.39%
30.8th percentile
Missing filtering when the helmRepoURLRegex field isn't set on a GitRepo resource in SUSE Rancher Fleet's bundle reader in 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.15 forwards Helm authentication credentials (BasicAuth) to any URL specified in the helm.repo field of a fleet.yaml file, allowing attackers able to push to fleet monitored git repos to leak helm access credentials.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | rancher_fleet | >= 0.12.0 < 0.12.15 | 0.12.15 |
| github.com | rancher_fleet | >= 0.13.0 < 0.13.11 | 0.13.11 |
| github.com | rancher_fleet | >= 0.14.0 < 0.14.6 | 0.14.6 |
| github.com | rancher_fleet | >= 0.15.0 < 0.15.2 | 0.15.2 |
| suse | rancher | >= 0.12.0 < 0.12.15 | 0.12.15 |
| suse | rancher | >= 0.13.0 < 0.13.11 | 0.13.11 |
| suse | rancher | >= 0.14.0 < 0.14.6 | 0.14.6 |
| suse | rancher | >= 0.15.0 < 0.15.2 | 0.15.2 |
| suse | rancher_fleet | >= 0.12.0 < 0.12.15 | 0.12.15 |
| suse | rancher_fleet | >= 0.13.0 < 0.13.11 | 0.13.11 |
| suse | rancher_fleet | >= 0.14.0 < 0.14.6 | 0.14.6 |
| suse | rancher_fleet | >= 0.15.0 < 0.15.2 | 0.15.2 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
SUSE Rancher up to 0.12.14/0.13.10/0.14.5/0.15.1 Bundle Reader fleet.yaml helmRepoURLRegex incorrect regex (EUVD-2026-41863)
vuldb·2026-07-12·CVSS 5.0
CVE-2026-44936 [MEDIUM] SUSE Rancher up to 0.12.14/0.13.10/0.14.5/0.15.1 Bundle Reader fleet.yaml helmRepoURLRegex incorrect regex (EUVD-2026-41863)
A vulnerability identified as problematic has been detected in SUSE Rancher up to 0.12.14/0.13.10/0.14.5/0.15.1. This affects an unknown part of the file fleet.yaml of the component Bundle Reader. Performing a manipulation of the argument helmRepoURLRegex results in incorrect regular expression.
This vulnerability is known as CVE-2026-44936. Remote exploitation of the attack is possible. No exploit is available.
GHSA
Rancher Fleet has SSRF in Bundle Reader via Unvalidated Helm Repository URL in fleet.yaml
ghsa·2026-07-01
CVE-2026-44936 [MEDIUM] CWE-918 Rancher Fleet has SSRF in Bundle Reader via Unvalidated Helm Repository URL in fleet.yaml
Rancher Fleet has SSRF in Bundle Reader via Unvalidated Helm Repository URL in fleet.yaml
### Impact
A vulnerability has been identified in Fleet when the `helmRepoURLRegex` field isn't set on a `GitRepo` resource. Fleet's bundle reader forwards Helm authentication credentials (`BasicAuth`) to any URL specified in the `helm.repo` field of a `fleet.yaml` file.
An attacker with git push access to a Fleet-monitored repository can exploit this behavior by specifying a malicious URL in `helm.repo`. This causes the Fleet controller to send the configured Helm repository credentials to the attacker’s server.
As a result, the attacker can capture the username and password that an administrator configured to access a private Helm chart repository. However, the response body from the attacker's s
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-07-06
Published