CVE-2026-93537: A user who can supply bundle content to a repository referenced by a GitRepo resource, for example through Git push access, or through permission to create or…

PriorityP343medium6.5CVSS 3.1

AVNACLPRLUINSUCHINAN

EPSS

0.31%

22.4th percentile

A user who can supply bundle content to a repository referenced by a GitRepo resource, for example through Git push access, or through permission to create or modify a GitRepo, can cause SUSE Rancher Fleet to read files from the filesystem of the environment that processes the bundle and include their contents in the generated Bundle resource. This can expose configuration or credential material that the user has no Kubernetes RBAC permission to read, including Helm registry credentials made available to the bundle-processing job when per-path Helm credentials are configured. This affects Fleet 0.16 before 0.16.2, 0.15 before 0.15.7, 0.14 before 0.14.11, 0.13 before 0.13.16, 0.12 before 0.12.20 and potentially older unsupported versions.

Affected

10 ranges

Vendor	Product	Version range	Fixed in
suse	rancher	>= 0.12.0 < 0.12.20	0.12.20
suse	rancher	>= 0.13.0 < 0.13.16	0.13.16
suse	rancher	>= 0.14.0 < 0.14.11	0.14.11
suse	rancher	>= 0.15.0 < 0.15.7	0.15.7
suse	rancher	>= 0.16.0 < 0.16.2	0.16.2
suse	rancher_fleet	>= 0.12.0 < 0.12.20	0.12.20
suse	rancher_fleet	>= 0.13.0 < 0.13.16	0.13.16
suse	rancher_fleet	>= 0.14.0 < 0.14.11	0.14.11
suse	rancher_fleet	>= 0.15.0 < 0.15.7	0.15.7
suse	rancher_fleet	>= 0.16.0 < 0.16.2	0.16.2

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.