Description
Missing filtering when the helmRepoURLRegex field isn't set on a GitRepo resource in SUSE Rancher Fleet's bundle reader in 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.15 forwards Helm authentication credentials (BasicAuth) to any URL specified in the helm.repo field of a fleet.yaml file, allowing attackers able to push to fleet monitored git repos to leak helm access credentials.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| SUSE | Rancher | 0.15.0 – < 0.15.2, 0.14.0 – < 0.14.6, 0.13.0 – < 0.13.11, 0.12.0 – < 0.12.15 | 0.15.2 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 | openSUSE-SU-2026:21483-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/rancher/fleet | >= 0.15.0, < 0.15.2 | 0.15.2 | GHSA-hx4v-cxpf-vh8m |
| Go | github.com/rancher/fleet | >= 0.14.0, < 0.14.6 | 0.14.6 | GHSA-hx4v-cxpf-vh8m |
| Go | github.com/rancher/fleet | >= 0.13.0, < 0.13.11 | 0.13.11 | GHSA-hx4v-cxpf-vh8m |
| Go | github.com/rancher/fleet | >= 0.12.0, < 0.12.15 | 0.12.15 | GHSA-hx4v-cxpf-vh8m |
| Go | github.com/rancher/fleet | >= 0.12.0, < 0.12.15 · >= 0.13.0, < 0.13.11 · >= 0.14.0, < 0.14.6 · >= 0.15.0, < 0.15.2 | 0.12.15, 0.13.11, 0.14.6, 0.15.2 | GO-2026-5873 |
Advisories 2
- openSUSE-SU-2026:21483-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Jul 31, 2026
- WID-SEC-2026-1715 Fleet: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 7, 2026
References
- https://github.com/advisories/GHSA-hx4v-cxpf-vh8m vendor-advisory