Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm Deployer
Priority MEDIUM 43CWE-1287Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-863.
Summary
Missing validation of "valuesFrom" references in Helm Deployer of SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.15 could be used by owners of one tenant to access fleet credentials of other tenants.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0049 42nd percentileScored 2026-11-07
Fix Fixed Rancher (SUSE): 0.15.2, 0.14.6, 0.13.11 +1github.com/rancher/fleet (Go): 0.15.2, 0.14.6, 0.13.11 +1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| SUSE | Rancher | 0.15.0 to before 0.15.2; 0.14.0 to before 0.14.6; 0.13.0 to before 0.13.11; 0.12.0 to before 0.12.15 | 0.15.2, 0.14.6, 0.13.11, 0.12.15 | Patch available | CNA |
| — | github.com/rancher/fleet (Go) | 0.15.0 to before 0.15.2 | 0.15.2 | Patch available | GHSA-xr65-5cpm-g36x |
| — | github.com/rancher/fleet (Go) | 0.14.0 to before 0.14.6 | 0.14.6 | Patch available | GHSA-xr65-5cpm-g36x |
| — | github.com/rancher/fleet (Go) | 0.13.0 to before 0.13.11 | 0.13.11 | Patch available | GHSA-xr65-5cpm-g36x |
| — | github.com/rancher/fleet (Go) | 0.12.0 to before 0.12.15 | 0.12.15 | Patch available | GHSA-xr65-5cpm-g36x |
- Rancher VendorSUSE Affected 0.15.0 to before 0.15.2; 0.14.0 to before 0.14.6; 0.13.0 to before 0.13.11; 0.12.0 to before 0.12.15 Fixed in 0.15.2, 0.14.6, 0.13.11, 0.12.15 Patch available CNA
- github.com/rancher/fleet (Go) Vendor— Affected 0.15.0 to before 0.15.2 Fixed in 0.15.2 Patch available GHSA-xr65-5cpm-g36x
- github.com/rancher/fleet (Go) Vendor— Affected 0.14.0 to before 0.14.6 Fixed in 0.14.6 Patch available GHSA-xr65-5cpm-g36x
- github.com/rancher/fleet (Go) Vendor— Affected 0.13.0 to before 0.13.11 Fixed in 0.13.11 Patch available GHSA-xr65-5cpm-g36x
- github.com/rancher/fleet (Go) Vendor— Affected 0.12.0 to before 0.12.15 Fixed in 0.12.15 Patch available GHSA-xr65-5cpm-g36x
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:suse:rancher_fleet:*:*:*:*:*:*:*:* | 0.12.0 to before 0.12.15; 0.13.0 to before 0.13.11; 0.14.0 to before 0.14.6; 0.15.0 to before 0.15.2 | Vulnerable | SUSE |
- cpe:2.3:a:suse:rancher_fleet:*:*:*:*:*:*:*:* Versions 0.12.0 to before 0.12.15; 0.13.0 to before 0.13.11; 0.14.0 to before 0.14.6; 0.15.0 to before 0.15.2 Vulnerable ·SUSE
Remediation
- Fix · CNA Rancher (SUSE) Fixed in 0.15.2, 0.14.6, 0.13.11, 0.12.15
- Fix · GHSA-xr65-5cpm-g36x github.com/rancher/fleet (Go) Fixed in 0.15.2 Advisory →
- Fix · GHSA-xr65-5cpm-g36x github.com/rancher/fleet (Go) Fixed in 0.14.6 Advisory →
- Fix · GHSA-xr65-5cpm-g36x github.com/rancher/fleet (Go) Fixed in 0.13.11 Advisory →
- Fix · GHSA-xr65-5cpm-g36x github.com/rancher/fleet (Go) Fixed in 0.12.15 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-44935
- 2026-10-03 Alias added: GHSA-xr65-5cpm-g36x
References
More SUSE Rancher Fleet vulnerabilities
- TI-2026-29689 Helm impersonation bypass of `RESTClientGetter` retains `cluster-admin` during template rendering CVSS 3.1CRITICAL 9.9
- TI-2026-60216 Fleet agent copies downstream resources with cluster-admin privileges, allowing… CVSS 3.1HIGH 8.8
- TI-2026-32804 Fleet has PSS Bypass through addLabelsFromOptions in Fleet Agent CVSS 3.1HIGH 8.8
- TI-2026-32803 SUSE Rancher Fleet had an Unauthenticated Webhook: Regex Injection via Unsanitized Repository URL Components CVSS 4.0HIGH 8.3
- TI-2026-63018 Authentication bypass by spoofing in SUSE Rancher CVSS 3.1HIGH 7.1
- TI-2026-63017 Path traversal in Fleet Helm valuesFiles allows disclosure of files outside the bundle directory CVSS 3.1MEDIUM 6.5
Sources
- CVE-2026-44935 · CVE Program
- CVE-2026-44935 · NVD
- FIRST EPSS
- GHSA-xr65-5cpm-g36x · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences