CVE-2026-93538: A cross-tenant authorization issue was discovered in SUSE Rancher Fleet. During agent-initiated cluster registration, cluster labels supplied by the…

PriorityP341high7.1CVSS 3.1

AVNACLPRLUINSUCHILAN

EPSS

0.17%

6.2th percentile

A cross-tenant authorization issue was discovered in SUSE Rancher Fleet. During agent-initiated cluster registration, cluster labels supplied by the registering agent, including labels in the reserved management.cattle.io/ namespace such as the cluster display name label, were applied to the resulting upstream Cluster object. Because Fleet resolves GitRepo and Bundle targets from those cluster labels, a party able to register a cluster into a Fleet workspace namespace shared with other tenants could cause its own cluster to satisfy targeting rules that administrators intended for a different cluster. This affects SUSE Rancher Fleet 0.16 before 0.16.1, 0.15 before 0.15.6, 0.14 before 0.14.10, 0.13 before 0.13.15, 0.12 before 0.12.19 and older versions.

Affected

10 ranges

Vendor	Product	Version range	Fixed in
suse	rancher	>= 0.12.0 < 0.12.19	0.12.19
suse	rancher	>= 0.13.0 < 0.13.15	0.13.15
suse	rancher	>= 0.14.0 < 0.14.10	0.14.10
suse	rancher	>= 0.15.0 < 0.15.6	0.15.6
suse	rancher	>= 0.16.0 < 0.16.1	0.16.1
suse	rancher_fleet	>= 0.12.0 < 0.12.19	0.12.19
suse	rancher_fleet	>= 0.13.0 < 0.13.15	0.13.15
suse	rancher_fleet	>= 0.14.0 < 0.14.10	0.14.10
suse	rancher_fleet	>= 0.15.0 < 0.15.6	0.15.6
suse	rancher_fleet	>= 0.16.0 < 0.16.1	0.16.1

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.