CVE-2026-44935

Missing validation of "valuesFrom" references in Helm Deployer of SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.15 could be used by owners of one tenant to access fleet credentials of other tenants.

Score

CVSS 3.1 9.9 Critical

Status

Analyzed - meissner@suse.de

Published

2026-07-02

Last modified

2026-10-25

Weaknesses

CWE-1287

Affected products

• Rancher (Suse)
• Rancher Fleet (Suse)

References

• https://github.com/rancher/fleet/security/advisories/GHSA-xr65-5cpm-g36x