Path Traversal in Rancher Fleet ImageScan GitRepo Path Handler
Priority LOW 25CWE-23Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
A path traversal vulnerability was found in Fleet's ImageScan subsystem in Rancher Fleet 0.12.0 up to 0.12.16, 0.13.0 up to 0.13.12, 0.14.0 up to 0.14.7 and 0.15.0 up to 0.15.3 could be used to traverse outside of the intended directory, causing a denial of service.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00487 42nd percentileScored 2026-11-07
Fix Fixed Rancher (SUSE): 0.12.16, 0.13.12, 0.14.7 +1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| SUSE | Rancher | 0.12.0 to before 0.12.16; 0.13.0 to before 0.13.12; 0.14.0 to before 0.14.7; 0.15.0 to before 0.15.3 | 0.12.16, 0.13.12, 0.14.7, 0.15.3 | Patch available | CNA |
- Rancher VendorSUSE Affected 0.12.0 to before 0.12.16; 0.13.0 to before 0.13.12; 0.14.0 to before 0.14.7; 0.15.0 to before 0.15.3 Fixed in 0.12.16, 0.13.12, 0.14.7, 0.15.3 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:suse:rancher_fleet:*:*:*:*:*:*:*:* | 0.12.0 to before 0.12.16; 0.13.0 to before 0.13.12; 0.14.0 to before 0.14.7; 0.15.0 to before 0.15.3 | Vulnerable | SUSE |
- cpe:2.3:a:suse:rancher_fleet:*:*:*:*:*:*:*:* Versions 0.12.0 to before 0.12.16; 0.13.0 to before 0.13.12; 0.14.0 to before 0.14.7; 0.15.0 to before 0.15.3 Vulnerable ·SUSE
Remediation
- Fix · CNA Rancher (SUSE) Fixed in 0.12.16, 0.13.12, 0.14.7, 0.15.3
Timeline
- 2026-10-02 Threatist record created from CVE-2026-44948
- 2026-10-20 CVSS score added · NVD
References
More SUSE Rancher Fleet vulnerabilities
- TI-2026-32801 Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm Deployer CVSS 3.1CRITICAL 9.9
- TI-2026-29689 Helm impersonation bypass of `RESTClientGetter` retains `cluster-admin` during template rendering CVSS 3.1CRITICAL 9.9
- TI-2026-60216 Fleet agent copies downstream resources with cluster-admin privileges, allowing… CVSS 3.1HIGH 8.8
- TI-2026-32804 Fleet has PSS Bypass through addLabelsFromOptions in Fleet Agent CVSS 3.1HIGH 8.8
- TI-2026-32803 SUSE Rancher Fleet had an Unauthenticated Webhook: Regex Injection via Unsanitized Repository URL Components CVSS 4.0HIGH 8.3
- TI-2026-63018 Authentication bypass by spoofing in SUSE Rancher CVSS 3.1HIGH 7.1
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences