CVE-2026-93539: A vulnerability was discovered in Fleet's Git webhook receiver (the gitjob webhook service). When a webhook secret is not configured, incoming webhook requests…

PriorityP433medium5.4CVSS 3.1

AVNACLPRLUINSUCNILAL

EPSS

0.23%

13.4th percentile

A vulnerability was discovered in Fleet's Git webhook receiver (the gitjob webhook service). When a webhook secret is not configured, incoming webhook requests are accepted without verification, and processing a request can change the spec.pollingInterval field of a matching GitRepo resource in any namespace. A caller with network access to the webhook service and no Kubernetes credentials can therefore alter GitRepo configuration outside the namespaces they are authorized for. This only affects SUSE Rancher Fleet 0.16 before 0.16.2, older versions are not affected.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
suse	rancher	>= 0.16.0 < 0.16.2	0.16.2
suse	rancher_fleet	>= 0.16.0 < 0.16.2	0.16.2

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.