Suse Rancher Fleet vulnerabilities

CVE-2026-44935 [CRITICAL] CWE-1287 CVE-2026-44935: Missing validation of "valuesFrom" references in Helm Deployer of SUSE Rancher Fleet 0.15 before 0.1 Missing validation of "valuesFrom" references in Helm Deployer of SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.15 could be used by owners of one tenant to access fleet credentials of other tenants.

CVE-2026-41050 [CRITICAL] CWE-863 CVE-2026-41050: Fleet's Helm deployer did not fully apply ServiceAccount impersonation in two code paths, allowing a Fleet's Helm deployer did not fully apply ServiceAccount impersonation in two code paths, allowing a tenant with git push access to a Fleet-monitored repository to read secrets from any namespace on every downstream cluster targeted by their `GitRepo`.

CVE-2026-44938 [HIGH] CWE-522 CVE-2026-44938: A vulnerability has been identified in Fleet's agent-side deployer, which did not filter security-se A vulnerability has been identified in Fleet's agent-side deployer, which did not filter security-sensitive keys from namespaceLabels in fleet.yaml (or BundleDeployment.spec.options.namespaceLabels) when applying them to the target namespace. An attacker with git push access to a Fleet-monitored repository could overwrite Pod Security Standards (PSS

CVE-2026-88808 [HIGH] CWE-250 CVE-2026-88808: A vulnerability has been identified within Rancher Manager where the Fleet agent wrote resources to A vulnerability has been identified within Rancher Manager where the Fleet agent wrote resources to downstream clusters using its own cluster-admin credentials instead of the ServiceAccount pinned to the deployment. It affects multi-tenancy environments where different tenants share the same downstream clusters, for example different privileged or untr

CVE-2026-44937 [HIGH] CWE-918 CVE-2026-44937: Potential forgery of webhook requests when using a unauthenticated webhook in SUSE Rancher Fleet 0.1 Potential forgery of webhook requests when using a unauthenticated webhook in SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.5 could be used by remote attackers to cause a denial of service or a downgrade attack on other repositories on the system.

CVE-2026-93537 [MEDIUM] CWE-23 CVE-2026-93537: A user who can supply bundle content to a repository referenced by a GitRepo resource, for example t A user who can supply bundle content to a repository referenced by a GitRepo resource, for example through Git push access, or through permission to create or modify a GitRepo, can cause SUSE Rancher Fleet to read files from the filesystem of the environment that processes the bundle and include their contents in the generated Bundle resource. This c

CVE-2026-93538 [HIGH] CWE-290 CVE-2026-93538: A cross-tenant authorization issue was discovered in SUSE Rancher Fleet. During agent-initiated clus A cross-tenant authorization issue was discovered in SUSE Rancher Fleet. During agent-initiated cluster registration, cluster labels supplied by the registering agent, including labels in the reserved management.cattle.io/ namespace such as the cluster display name label, were applied to the resulting upstream Cluster object. Because Fleet resolves Gi

CVE-2026-93540 [MEDIUM] CWE-266 CVE-2026-93540: A privilege mismatch was found in Fleet. When a bundle requested namespace labels or annotations thr A privilege mismatch was found in Fleet. When a bundle requested namespace labels or annotations through the namespaceLabels and namespaceAnnotations options, the resulting namespace metadata update was not subject to the same authorization as the rest of the bundle's deployment. As a result, a bundle could change labels and annotations on a target

CVE-2026-93539 [MEDIUM] CWE-306 CVE-2026-93539: A vulnerability was discovered in Fleet's Git webhook receiver (the gitjob webhook service). When a A vulnerability was discovered in Fleet's Git webhook receiver (the gitjob webhook service). When a webhook secret is not configured, incoming webhook requests are accepted without verification, and processing a request can change the spec.pollingInterval field of a matching GitRepo resource in any namespace. A caller with network access to the webho

CVE-2026-44936 [MEDIUM] CWE-918 CVE-2026-44936: Missing filtering when the helmRepoURLRegex field isn't set on a GitRepo resource in SUSE Rancher Fl Missing filtering when the helmRepoURLRegex field isn't set on a GitRepo resource in SUSE Rancher Fleet's bundle reader in 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.15 forwards Helm authentication credentials (BasicAuth) to any URL specified in the helm.repo field of a fleet.yaml file, allowing attackers able t

CVE-2026-44948 [MEDIUM] CWE-23 CVE-2026-44948: A path traversal vulnerability was found in Fleet's ImageScan subsystem in Rancher Fleet 0.12.0 up t A path traversal vulnerability was found in Fleet's ImageScan subsystem in Rancher Fleet 0.12.0 up to 0.12.16, 0.13.0 up to 0.13.12, 0.14.0 up to 0.14.7 and 0.15.0 up to 0.15.3 could be used to traverse outside of the intended directory, causing a denial of service.

CVE-2026-75036 [MEDIUM] CWE-918 CVE-2026-75036: A security vulnerability was discovered in Fleet's Helm template preprocessing where templates evalu A security vulnerability was discovered in Fleet's Helm template preprocessing where templates evaluated by the Fleet controller could reach network resources outside the management cluster. A user who can supply bundle content to a repository referenced by a `GitRepo` resource can cause the Fleet controller to: - Disclose cluster metadata available