Rancher Fleet (Suse) - vulnerabilities (CVEs)
12 CVEs, 5 in the last 30 days, 604 known versions, newest CVE from 2026-09-28. Vendor: Suse.
CVEs of Rancher Fleet
- CVE-2026-88808 - CVSS 8.8 (high), 2026-09-28: A vulnerability has been identified within Rancher Manager where the Fleet agent wrote resources to downstream clusters using its own cluster-admin…
- CVE-2026-93540 - CVSS 6.5 (medium), 2026-09-28: A privilege mismatch was found in Fleet. When a bundle requested namespace labels or annotations through the namespaceLabels and namespaceAnnotations options,…
- CVE-2026-93539 - CVSS 5.4 (medium), 2026-09-28: A vulnerability was discovered in Fleet's Git webhook receiver (the gitjob webhook service). When a webhook secret is not configured, incoming webhook…
- CVE-2026-93538 - CVSS 7.1 (high), 2026-09-28: A cross-tenant authorization issue was discovered in SUSE Rancher Fleet. During agent-initiated cluster registration, cluster labels supplied by the…
- CVE-2026-93537 - CVSS 6.5 (medium), 2026-09-28: A user who can supply bundle content to a repository referenced by a GitRepo resource, for example through Git push access, or through permission to create or…
- CVE-2026-75036 - CVSS 5.3 (medium), 2026-09-03: A security vulnerability was discovered in Fleet's Helm template preprocessing where templates evaluated by the Fleet controller could reach network resources…
- CVE-2026-44938 - CVSS 8.8 (high), 2026-07-07: A vulnerability has been identified in Fleet's agent-side deployer, which did not filter security-sensitive keys from namespaceLabels in fleet.yaml (or…
- CVE-2026-44937 - CVSS 8.3 (high), 2026-07-06: Potential forgery of webhook requests when using a unauthenticated webhook in SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11…
- CVE-2026-44936 - CVSS 5 (medium), 2026-07-06: Missing filtering when the helmRepoURLRegex field isn't set on a GitRepo resource in SUSE Rancher Fleet's bundle reader in 0.15 before 0.15.2, 0.14 before…
- CVE-2026-44935 - CVSS 9.9 (critical), 2026-07-02: Missing validation of "valuesFrom" references in Helm Deployer of SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12…
- CVE-2026-44948 - CVSS 5.3 (medium), 2026-06-30: A path traversal vulnerability was found in Fleet's ImageScan subsystem in Rancher Fleet 0.12.0 up to 0.12.16, 0.13.0 up to 0.13.12, 0.14.0 up to 0.14.7 and…
- CVE-2026-41050 - CVSS 9.9 (critical), 2026-05-13: Fleet's Helm deployer did not fully apply ServiceAccount impersonation in two code paths, allowing a tenant with git push access to a Fleet-monitored…
