Read the docs
TI-2026-63017 Aliases CVE-2026-93537

Path traversal in Fleet Helm valuesFiles allows disclosure of files outside the bundle directory

Priority LOW 29CWE-23Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-23 and the CVSS impact.

Summary

A user who can supply bundle content to a repository referenced by a GitRepo resource, for example through Git push access, or through permission to create or modify a GitRepo, can cause SUSE Rancher Fleet to read files from the filesystem of the environment that processes the bundle and include their contents in the generated Bundle resource. This can expose configuration or credential material that the user has no Kubernetes RBAC permission to read, including Helm registry credentials made available to the bundle-processing job when per-path Helm credentials are configured. This affects Fleet 0.16 before 0.16.2, 0.15 before 0.15.7, 0.14 before 0.14.11, 0.13 before 0.13.16, 0.12 before 0.12.20 and potentially older unsupported versions.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00308 23rd percentileScored 2026-11-07
Fix Fixed Rancher (SUSE): 0.16.2, 0.15.7, 0.14.11 +2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SUSERancher0.16.0 to before 0.16.2; 0.15.0 to before 0.15.7; 0.14.0 to before 0.14.11; 0.13.0 to before 0.13.16; 0.12.0 to before 0.12.200.16.2, 0.15.7, 0.14.11, 0.13.16, 0.12.20Patch availableCNA
  • Rancher VendorSUSE Affected 0.16.0 to before 0.16.2; 0.15.0 to before 0.15.7; 0.14.0 to before 0.14.11; 0.13.0 to before 0.13.16; 0.12.0 to before 0.12.20 Fixed in 0.16.2, 0.15.7, 0.14.11, 0.13.16, 0.12.20 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:suse:rancher_fleet:*:*:*:*:*:*:*:*0.12.0 to before 0.12.20; 0.13.0 to before 0.13.16; 0.14.0 to before 0.14.11; 0.15.0 to before 0.15.7; 0.16.0 to before 0.16.2VulnerableSUSE
  • cpe:2.3:a:suse:rancher_fleet:*:*:*:*:*:*:*:* Versions 0.12.0 to before 0.12.20; 0.13.0 to before 0.13.16; 0.14.0 to before 0.14.11; 0.15.0 to before 0.15.7; 0.16.0 to before 0.16.2 Vulnerable ·SUSE

Remediation

  • Fix · CNA Rancher (SUSE) Fixed in 0.16.2, 0.15.7, 0.14.11, 0.13.16, 0.12.20

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-93537

References

Advisory 1

  • TI-2026-32801 Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm Deployer CVSS 3.1CRITICAL 9.9
  • TI-2026-29689 Helm impersonation bypass of `RESTClientGetter` retains `cluster-admin` during template rendering CVSS 3.1CRITICAL 9.9
  • TI-2026-60216 Fleet agent copies downstream resources with cluster-admin privileges, allowing… CVSS 3.1HIGH 8.8
  • TI-2026-32804 Fleet has PSS Bypass through addLabelsFromOptions in Fleet Agent CVSS 3.1HIGH 8.8
  • TI-2026-32803 SUSE Rancher Fleet had an Unauthenticated Webhook: Regex Injection via Unsanitized Repository URL Components CVSS 4.0HIGH 8.3
  • TI-2026-63018 Authentication bypass by spoofing in SUSE Rancher CVSS 3.1HIGH 7.1
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences