Skip to content
OpenAdvisories
High WID-SEC-2026-1715 4 CVEs

Fleet: Mehrere Schwachstellen

Published May 27, 2026 · Updated Jul 7, 2026 · Revision 4 · de-DE

Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in Fleet ausnutzen, um Sicherheitsmechanismen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuführen oder Sicherheitskonfigurationen zu manipulieren.

Product

Fleet ist eine Open-Source-Plattform zur Geräteverwaltung, die es Unternehmen ermöglicht, ihre Infrastruktur zu überwachen und zu sichern.

Vulnerabilities 4

  • Critical 9.9
    CVE-2026-44935

    Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm Deployer

    Missing validation of "valuesFrom" references in Helm Deployer of SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.15 could be used by owners of one tenant to access fleet credentials of other tenants.

    SUSE Rancher github.com/rancher/fleet Go
  • High 8.8
    CVE-2026-44938

    Fleet has PSS Bypass through addLabelsFromOptions in Fleet Agent

    A vulnerability has been identified in Fleet's agent-side deployer, which did not filter security-sensitive keys from namespaceLabels in fleet.yaml (or BundleDeployment.spec.options.namespaceLabels) when applying them to the target namespace. An attacker with…

    SUSE Rancher github.com/rancher/fleet Go
  • High 8.3
    CVE-2026-44937

    SUSE Rancher Fleet had an Unauthenticated Webhook: Regex Injection via Unsanitized Repository URL Components

    Potential forgery of webhook requests when using a unauthenticated webhook in SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.5 could be used by remote attackers to cause a denial of service or a downgrade a…

    SUSE Rancher github.com/rancher/fleet Go
  • Medium 5.0
    CVE-2026-44936

    Rancher Fleet SSRF in Bundle Reader via Unvalidated Helm Repository URL in fleet.yaml

    Missing filtering when the helmRepoURLRegex field isn't set on a GitRepo resource in SUSE Rancher Fleet's bundle reader in 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.15 forwards Helm authentication credentials (BasicAuth)…

    SUSE Rancher github.com/rancher/fleet Go

Revision history

  1. #4

    Referenz(en) aufgenommen: EUVD-2026-42039

  2. #3

    Referenz(en) aufgenommen: EUVD-2026-41863, EUVD-2026-41867

  3. #2

    Referenz(en) aufgenommen: EUVD-2026-41408

  4. #1

    Initiale Fassung

References