Skip to content
OpenAdvisories

Package · Go

github.com/rancher/fleet

7 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.9
    CVE-2026-44935

    Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm Deployer

    Missing validation of "valuesFrom" references in Helm Deployer of SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.15 could be used by owners of one tenant to access fleet credentials of other tenants.

    SUSE Rancher github.com/rancher/fleet Go
  • Critical 9.9
    CVE-2026-41050

    Helm impersonation bypass of `RESTClientGetter` retains `cluster-admin` during template rendering

    Fleet's Helm deployer did not fully apply ServiceAccount impersonation in two code paths, allowing a tenant with git push access to a Fleet-monitored repository to read secrets from any namespace on every downstream cluster targeted by their `GitRepo`.

    SUSE Rancher github.com/rancher/fleet Go