Vulnerabilities

TI-2026-60216 CVE-2026-88808

Fleet agent copies downstream resources with cluster-admin privileges, allowing…

MEDIUM 40

A vulnerability has been identified within Rancher Manager where the Fleet agent wrote resources to downstream clusters using its own cluster-admin credentials instead of the ServiceAccount pinned to the deployment.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00278 Published 2026-09-28 Fixed in 0.16.2, 0.15.7 +1 CWE-250

TI-2026-63020 CVE-2026-93540

Fleet applies namespace labels and annotations without the bundle's service account privileges

LOW 28

A privilege mismatch was found in Fleet.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00174 Published 2026-09-28 Fixed in 0.16.1, 0.15.7 +2 CWE-266

TI-2026-63019 CVE-2026-93539

Unauthenticated GitRepo Spec Mutation via Fleet Git Webhook Receiver

LOW 24

A vulnerability was discovered in Fleet's Git webhook receiver (the gitjob webhook service).

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00233 Published 2026-09-28 Fixed in 0.16.2 CWE-306

TI-2026-63018 CVE-2026-93538

Authentication bypass by spoofing in SUSE Rancher

LOW 30

A cross-tenant authorization issue was discovered in SUSE Rancher Fleet.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00171 Published 2026-09-28 Fixed in 0.16.1, 0.15.6 +3 CWE-290

TI-2026-63017 CVE-2026-93537

Path traversal in Fleet Helm valuesFiles allows disclosure of files outside the bundle directory

LOW 29

A user who can supply bundle content to a repository referenced by a GitRepo resource, for example through Git push access, or through permission to create or modify a GitRepo, can cause SUSE Rancher Fleet to read files…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00308 Published 2026-09-28 Fixed in 0.16.2, 0.15.7 +3 CWE-23

TI-2026-52727 CVE-2026-75036

Fleet: DNS exfiltration via Sprig getHostByName in fleet.yaml Helm template preprocessing

LOW 23

A security vulnerability was discovered in Fleet's Helm template preprocessing where templates evaluated by the Fleet controller could reach network resources outside the management cluster.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00162 Published 2026-09-03 Fixed in 0.12.19, 0.13.15 +3 CWE-1336

TI-2026-32804 CVE-2026-44938 · GHSA-864g-863m-vcvq

Fleet has PSS Bypass through addLabelsFromOptions in Fleet Agent

MEDIUM 40

A vulnerability has been identified in Fleet's agent-side deployer, which did not filter security-sensitive keys from namespaceLabels in fleet.yaml (or BundleDeployment.spec.options.namespaceLabels) when applying them to…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00442 Published 2026-07-07 Fixed in 0.15.2, 0.14.6 +2 CWE-522

TI-2026-32803 CVE-2026-44937 · GHSA-jmf4-m7j9-g72r

SUSE Rancher Fleet had an Unauthenticated Webhook: Regex Injection via Unsanitized Repository URL Components

LOW 36

Potential forgery of webhook requests when using a unauthenticated webhook in SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.5 could be used by remote attackers to cau…

CVSS 4.0HIGH 8.3 Network No auth No interaction EPSS 0.00424 Published 2026-07-06 Fixed in 0.15.2, 0.14.6 +2 CWE-918

TI-2026-32802 CVE-2026-44936 · GHSA-hx4v-cxpf-vh8m

Rancher Fleet SSRF in Bundle Reader via Unvalidated Helm Repository URL in fleet.yaml

LOW 23

Missing filtering when the helmRepoURLRegex field isn't set on a GitRepo resource in SUSE Rancher Fleet's bundle reader in 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.15 forwards Helm…

CVSS 3.1MEDIUM 5.0 Network Low privileges No interaction EPSS 0.00348 Published 2026-07-06 Fixed in 0.15.2, 0.14.6 +2 CWE-918

TI-2026-32801 CVE-2026-44935 · GHSA-xr65-5cpm-g36x

Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm Deployer

MEDIUM 43

Missing validation of "valuesFrom" references in Helm Deployer of SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.15 could be used by owners of one tenant to access fle…

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.0049 Published 2026-07-02 Fixed in 0.15.2, 0.14.6 +2 CWE-1287

TI-2026-32814 CVE-2026-44948

Path Traversal in Rancher Fleet ImageScan GitRepo Path Handler

LOW 25

A path traversal vulnerability was found in Fleet's ImageScan subsystem in Rancher Fleet 0.12.0 up to 0.12.16, 0.13.0 up to 0.13.12, 0.14.0 up to 0.14.7 and 0.15.0 up to 0.15.3 could be used to traverse outside of the in…

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00487 Published 2026-06-30 Fixed in 0.12.16, 0.13.12 +2 CWE-23

TI-2026-29689 CVE-2026-41050 · GHSA-765j-qfrp-hm3j

Helm impersonation bypass of `RESTClientGetter` retains `cluster-admin` during template rendering

MEDIUM 43

Fleet's Helm deployer did not fully apply ServiceAccount impersonation in two code paths, allowing a tenant with git push access to a Fleet-monitored repository to read secrets from any namespace on every downstream clus…

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.0039 Published 2026-05-13 Fixed in 0.15.1, 0.14.5 +3 CWE-863

Vulnerabilities

Filters