Skip to content
OpenAdvisories
High WID-SEC-2026-3546 5 CVEs

Fleet: Mehrere Schwachstellen

Published Sep 23, 2026 · Updated Sep 28, 2026 · Revision 3 · de-DE

Summary

Ein Angreifer kann mehrere Schwachstellen in Fleet ausnutzen, um erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren oder offenzulegen und einen Denial-of-Service-Zustand auszulösen.

Product

Fleet ist eine GitOps-basierte Plattform zur zentralen Verwaltung, Bereitstellung und Überwachung von Kubernetes-Clustern.

Vulnerabilities 5

  • High 8.8
    CVE-2026-88808

    Fleet agent copies downstream resources with cluster-admin privileges, allowing cross-namespace writes on downstream clusters

    A vulnerability has been identified within Rancher Manager where the Fleet agent wrote resources to downstream clusters using its own cluster-admin credentials instead of the ServiceAccount pinned to the deployment. It affects multi-tenancy environments where…

    SUSE Rancher
  • High 7.1
    CVE-2026-93538

    Cross-tenant BundleDeployment and Secret disclosure via spoofed cluster labels during agent-initiated registration in Fleet

    A cross-tenant authorization issue was discovered in SUSE Rancher Fleet. During agent-initiated cluster registration, cluster labels supplied by the registering agent, including labels in the reserved management.cattle.io/ namespace such as the cluster displa…

    SUSE Rancher
  • Medium 6.5
    CVE-2026-93537

    Path traversal in Fleet Helm valuesFiles allows disclosure of files outside the bundle directory

    A user who can supply bundle content to a repository referenced by a GitRepo resource, for example through Git push access, or through permission to create or modify a GitRepo, can cause SUSE Rancher Fleet to read files from the filesystem of the environment …

    SUSE Rancher
  • Medium 6.5
    CVE-2026-93540

    Fleet applies namespace labels and annotations without the bundle's service account privileges

    A privilege mismatch was found in Fleet. When a bundle requested namespace labels or annotations through the namespaceLabels and namespaceAnnotations options, the resulting namespace metadata update was not subject to the same authorization as the rest of the…

    SUSE Rancher
  • Medium 5.4
    CVE-2026-93539

    Unauthenticated GitRepo Spec Mutation via Fleet Git Webhook Receiver

    A vulnerability was discovered in Fleet's Git webhook receiver (the gitjob webhook service). When a webhook secret is not configured, incoming webhook requests are accepted without verification, and processing a request can change the spec.pollingInterval fie…

    SUSE Rancher

Revision history

  1. #3

    Referenz(en) aufgenommen: EUVD-2026-88287, EUVD-2026-88296, EUVD-2026-88335, EUVD-2026-88316, EUVD-2026-88294

  2. #2

    Produktbeschreibung korrigiert

  3. #1

    Initiale Fassung

References