Read the docs
TI-2026-32802 Aliases CVE-2026-44936GHSA-hx4v-cxpf-vh8m

Rancher Fleet SSRF in Bundle Reader via Unvalidated Helm Repository URL in fleet.yaml

Priority LOW 23CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-918 and the CVSS impact.

Summary

Missing filtering when the helmRepoURLRegex field isn't set on a GitRepo resource in SUSE Rancher Fleet's bundle reader in 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.15 forwards Helm authentication credentials (BasicAuth) to any URL specified in the helm.repo field of a fleet.yaml file, allowing attackers able to push to fleet monitored git repos to leak helm access credentials.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00348 28th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Rancher (SUSE): 0.15.2, 0.14.6, 0.13.11 +1github.com/rancher/fleet (Go): 0.15.2, 0.14.6, 0.13.11 +1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SUSERancher0.15.0 to before 0.15.2; 0.14.0 to before 0.14.6; 0.13.0 to before 0.13.11; 0.12.0 to before 0.12.150.15.2, 0.14.6, 0.13.11, 0.12.15Patch availableCNA
—github.com/rancher/fleet (Go)0.15.0 to before 0.15.20.15.2Patch availableGHSA-hx4v-cxpf-vh8m
—github.com/rancher/fleet (Go)0.14.0 to before 0.14.60.14.6Patch availableGHSA-hx4v-cxpf-vh8m
—github.com/rancher/fleet (Go)0.13.0 to before 0.13.110.13.11Patch availableGHSA-hx4v-cxpf-vh8m
—github.com/rancher/fleet (Go)0.12.0 to before 0.12.150.12.15Patch availableGHSA-hx4v-cxpf-vh8m
  • Rancher VendorSUSE Affected 0.15.0 to before 0.15.2; 0.14.0 to before 0.14.6; 0.13.0 to before 0.13.11; 0.12.0 to before 0.12.15 Fixed in 0.15.2, 0.14.6, 0.13.11, 0.12.15 Patch available CNA
  • github.com/rancher/fleet (Go) Vendor— Affected 0.15.0 to before 0.15.2 Fixed in 0.15.2 Patch available GHSA-hx4v-cxpf-vh8m
  • github.com/rancher/fleet (Go) Vendor— Affected 0.14.0 to before 0.14.6 Fixed in 0.14.6 Patch available GHSA-hx4v-cxpf-vh8m
  • github.com/rancher/fleet (Go) Vendor— Affected 0.13.0 to before 0.13.11 Fixed in 0.13.11 Patch available GHSA-hx4v-cxpf-vh8m
  • github.com/rancher/fleet (Go) Vendor— Affected 0.12.0 to before 0.12.15 Fixed in 0.12.15 Patch available GHSA-hx4v-cxpf-vh8m

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:suse:rancher_fleet:*:*:*:*:*:*:*:*0.12.0 to before 0.12.15; 0.13.0 to before 0.13.11; 0.14.0 to before 0.14.6; 0.15.0 to before 0.15.2VulnerableSUSE
  • cpe:2.3:a:suse:rancher_fleet:*:*:*:*:*:*:*:* Versions 0.12.0 to before 0.12.15; 0.13.0 to before 0.13.11; 0.14.0 to before 0.14.6; 0.15.0 to before 0.15.2 Vulnerable ·SUSE

Remediation

  • Fix · CNA Rancher (SUSE) Fixed in 0.15.2, 0.14.6, 0.13.11, 0.12.15
  • Fix · GHSA-hx4v-cxpf-vh8m github.com/rancher/fleet (Go) Fixed in 0.15.2 Advisory →
  • Fix · GHSA-hx4v-cxpf-vh8m github.com/rancher/fleet (Go) Fixed in 0.14.6 Advisory →
  • Fix · GHSA-hx4v-cxpf-vh8m github.com/rancher/fleet (Go) Fixed in 0.13.11 Advisory →
  • Fix · GHSA-hx4v-cxpf-vh8m github.com/rancher/fleet (Go) Fixed in 0.12.15 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    SUSE Rancher 0.12.15, 0.13.11 and 2 more versions

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-32803 SUSE Rancher Fleet had an Unauthenticated Webhook: Regex Injection via Unsanitized Repository URL ComponentsPriority LOW 36
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-44936
  2. 2026-10-03 Alias added: GHSA-hx4v-cxpf-vh8m

References

Exploit 1

Other 2

  • TI-2026-32801 Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm Deployer CVSS 3.1CRITICAL 9.9
  • TI-2026-29689 Helm impersonation bypass of `RESTClientGetter` retains `cluster-admin` during template rendering CVSS 3.1CRITICAL 9.9
  • TI-2026-60216 Fleet agent copies downstream resources with cluster-admin privileges, allowing… CVSS 3.1HIGH 8.8
  • TI-2026-32804 Fleet has PSS Bypass through addLabelsFromOptions in Fleet Agent CVSS 3.1HIGH 8.8
  • TI-2026-32803 SUSE Rancher Fleet had an Unauthenticated Webhook: Regex Injection via Unsanitized Repository URL Components CVSS 4.0HIGH 8.3
  • TI-2026-63018 Authentication bypass by spoofing in SUSE Rancher CVSS 3.1HIGH 7.1
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences