Read the docs
TI-2026-52727 Aliases CVE-2026-75036

Fleet: DNS exfiltration via Sprig getHostByName in fleet.yaml Helm template preprocessing

Priority LOW 23CWE-1336Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution, Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-1336, CWE-918 and the CVSS impact.

Summary

A security vulnerability was discovered in Fleet's Helm template preprocessing where templates evaluated by the Fleet controller could reach network resources outside the management cluster. A user who can supply bundle content to a repository referenced by a `GitRepo` resource can cause the Fleet controller to: - Disclose cluster metadata available to the templating context. - Reveal information about hosts reachable from the controller's network position. Because the disclosure channel is name resolution, it may remain effective in environments where outbound traffic is otherwise restricted. The disclosed information is limited to values exposed to the Fleet templating context and to name resolution results. Integrity and availability of managed clusters are not affected. This issue affects Fleet: from 0.12.0 before 0.12.19, from 0.13.0 before 0.13.15, from 0.14.0 before 0.14.10, from 0.15.0 before 0.15.6, and from 0.16.0 before 0.16.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00162 5th percentileScored 2026-11-07
Fix Fixed Fleet (SUSE): 0.12.19, 0.13.15, 0.14.10 +2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SUSEFleet0.12.0 to before 0.12.19; 0.13.0 to before 0.13.15; 0.14.0 to before 0.14.10; 0.15.0 to before 0.15.6; 0.16.0 to before 0.16.10.12.19, 0.13.15, 0.14.10, 0.15.6, 0.16.1Patch availableCNA
  • Fleet VendorSUSE Affected 0.12.0 to before 0.12.19; 0.13.0 to before 0.13.15; 0.14.0 to before 0.14.10; 0.15.0 to before 0.15.6; 0.16.0 to before 0.16.1 Fixed in 0.12.19, 0.13.15, 0.14.10, 0.15.6, 0.16.1 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:suse:rancher_fleet:*:*:*:*:*:*:*:*0.12.0 to before 0.12.19; 0.13.0 to before 0.13.15; 0.14.0 to before 0.14.10; 0.15.0 to before 0.15.6; 0.16.0 to before 0.16.1VulnerableSUSE
  • cpe:2.3:a:suse:rancher_fleet:*:*:*:*:*:*:*:* Versions 0.12.0 to before 0.12.19; 0.13.0 to before 0.13.15; 0.14.0 to before 0.14.10; 0.15.0 to before 0.15.6; 0.16.0 to before 0.16.1 Vulnerable ·SUSE

Remediation

  • Fix · CNA Fleet (SUSE) Fixed in 0.12.19, 0.13.15, 0.14.10, 0.15.6, 0.16.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-75036
  2. 2026-10-07 CVSS score added · NVD

References

Advisory 1

  • TI-2026-32801 Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm Deployer CVSS 3.1CRITICAL 9.9
  • TI-2026-29689 Helm impersonation bypass of `RESTClientGetter` retains `cluster-admin` during template rendering CVSS 3.1CRITICAL 9.9
  • TI-2026-60216 Fleet agent copies downstream resources with cluster-admin privileges, allowing… CVSS 3.1HIGH 8.8
  • TI-2026-32804 Fleet has PSS Bypass through addLabelsFromOptions in Fleet Agent CVSS 3.1HIGH 8.8
  • TI-2026-32803 SUSE Rancher Fleet had an Unauthenticated Webhook: Regex Injection via Unsanitized Repository URL Components CVSS 4.0HIGH 8.3
  • TI-2026-63018 Authentication bypass by spoofing in SUSE Rancher CVSS 3.1HIGH 7.1
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences