Search
Find a vulnerability
Search criteria
176 vulnerabilities found for Rancher by SUSE
CVE-2026-88808 (GCVE-0-2026-88808)
Vulnerability from nvd – Published: 2026-09-28 15:36 – Updated: 2026-09-29 03:55
VLAI
EPSS
VEX
Title
Fleet agent copies downstream resources with cluster-admin privileges, allowing cross-namespace writes on downstream clusters
Summary
A vulnerability has been identified within Rancher Manager where the Fleet agent wrote resources to downstream clusters using its own cluster-admin credentials instead of the ServiceAccount pinned to the deployment. It affects multi-tenancy environments where different tenants share the same downstream clusters, for example different privileged or untrusted teams inside the same organization. This could lead to overwritten configuration files.
This issue affected SUSE Rancher Fleet 0.16 before 0.16.2, 0.15 before 0.15.7, and 0.14 before 0.14.11.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-28 00:00 UTC
CWE
- CWE-250 - Execution with unnecessary privileges
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/rancher/fleet/security/advisor… | vendor-advisory |
Impacted products
Date Public
2026-09-28 15:21
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-88808",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-28T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T03:55:24.347Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "Fleet",
"product": "Rancher",
"repo": "https://github.com/rancher/fleet/",
"vendor": "SUSE",
"versions": [
{
"lessThan": "0.16.2",
"status": "affected",
"version": "0.16.0",
"versionType": "semver"
},
{
"lessThan": "0.15.7",
"status": "affected",
"version": "0.15.0",
"versionType": "semver"
},
{
"lessThan": "0.14.11",
"status": "affected",
"version": "0.14.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.16.2",
"versionStartIncluding": "0.16.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.15.7",
"versionStartIncluding": "0.15.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.14.11",
"versionStartIncluding": "0.14.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "g.mygenie@gmail.com"
}
],
"datePublic": "2026-09-28T15:21:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eA vulnerability has been identified within Rancher Manager where the Fleet agent wrote resources to downstream clusters using its own cluster-admin credentials instead of the ServiceAccount pinned to the deployment. It affects multi-tenancy environments where different tenants share the same downstream clusters, for example different privileged or untrusted teams inside the same organization. This could lead to overwritten configuration files.\u003c/div\u003e\u003cdiv\u003eThis issue affected SUSE Rancher Fleet 0.16 before 0.16.2, 0.15 before 0.15.7, and 0.14 before 0.14.11.\u003c/div\u003e"
}
],
"value": "A vulnerability has been identified within Rancher Manager where the Fleet agent wrote resources to downstream clusters using its own cluster-admin credentials instead of the ServiceAccount pinned to the deployment. It affects multi-tenancy environments where different tenants share the same downstream clusters, for example different privileged or untrusted teams inside the same organization. This could lead to overwritten configuration files.\n\nThis issue affected SUSE Rancher Fleet 0.16 before 0.16.2, 0.15 before 0.15.7, and 0.14 before 0.14.11."
}
],
"impacts": [
{
"capecId": "CAPEC-180",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-250",
"description": "CWE-250 Execution with unnecessary privileges",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-28T15:36:13.506Z",
"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
"shortName": "suse"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://github.com/rancher/fleet/security/advisories/GHSA-q9v4-358v-r8q5"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Fleet agent copies downstream resources with cluster-admin privileges, allowing cross-namespace writes on downstream clusters",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
"assignerShortName": "suse",
"cveId": "CVE-2026-88808",
"datePublished": "2026-09-28T15:36:13.506Z",
"dateReserved": "2026-09-10T08:35:07.010Z",
"dateUpdated": "2026-09-29T03:55:24.347Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-88805 (GCVE-0-2026-88805)
Vulnerability from nvd – Published: 2026-09-28 15:50 – Updated: 2026-09-29 03:55
VLAI
EPSS
VEX
Title
Session Not Revoked Server-Side on Logout in Rancher
Summary
Incorrect credential cleaning on logout could be used by remote attackers to keep access credentials even after the account was logged out. Affected is SUSE Rancher 2.15 before 2.15.2.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-28 00:00 UTC
CWE
- CWE-613 - Insufficient session expiration
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/rancher/rancher/security/advis… | vendor-advisory |
Impacted products
Date Public
2026-09-28 15:40
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-88805",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-28T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T03:55:25.070Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "Rancher",
"product": "Rancher",
"repo": "https://github.com/rancher/rancher/",
"vendor": "SUSE",
"versions": [
{
"lessThan": "2.15.2",
"status": "affected",
"version": "2.15.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.15.2",
"versionStartIncluding": "2.15.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "info@cyberobserve.com"
}
],
"datePublic": "2026-09-28T15:40:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Incorrect credential cleaning on logout could be used by remote attackers to keep access credentials even after the account was logged out. Affected is SUSE Rancher 2.15 before 2.15.2."
}
],
"value": "Incorrect credential cleaning on logout could be used by remote attackers to keep access credentials even after the account was logged out. Affected is SUSE Rancher 2.15 before 2.15.2."
}
],
"impacts": [
{
"capecId": "CAPEC-21",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-21 Exploitation of Trusted Identifiers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-613",
"description": "CWE-613 Insufficient session expiration",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-28T15:50:34.591Z",
"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
"shortName": "suse"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://github.com/rancher/rancher/security/advisories/GHSA-6vpq-mf48-9794"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Session Not Revoked Server-Side on Logout in Rancher",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
"assignerShortName": "suse",
"cveId": "CVE-2026-88805",
"datePublished": "2026-09-28T15:50:34.591Z",
"dateReserved": "2026-09-10T08:35:07.010Z",
"dateUpdated": "2026-09-29T03:55:25.070Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-88804 (GCVE-0-2026-88804)
Vulnerability from nvd – Published: 2026-09-28 15:58 – Updated: 2026-09-28 18:02
VLAI
EPSS
VEX
Title
Unauthenticated update of public UI settings leading to stored cross-site scripting in Rancher
Summary
An unauthenticated update of public UI settings could be used by remote attackers to execute a stored cross-site scripting attack in the Rancher UI, in SUSE Rancher 2.15 before 2.15.2, 2.14 before 2.14.6, 2.13 before 2.13.10, 2.12 before 2.12.14 and 2.11 before 2.11.18.
Severity
9.6 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-28 16:31 UTC
CWE
- CWE-79 - Improper neutralization of input during web page generation ('cross-site scripting')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/rancher/rancher/security/advis… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| SUSE | Rancher |
Affected:
2.15.0 , < 2.15.2
(semver)
Affected: 2.14.0 , < 2.14.6 (semver) Affected: 2.13.0 , < 2.13.10 (semver) Affected: 2.12.0 , < 2.12.14 (semver) Affected: 2.11.0se , < 2.11.18 (semver) cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:* cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:* cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:* cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:* cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:* |
Date Public
2026-09-28 15:53
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-88804",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-28T16:31:06.472253Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-28T18:02:56.882Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "Rancher",
"product": "Rancher",
"repo": "https://github.com/rancher/rancher/",
"vendor": "SUSE",
"versions": [
{
"lessThan": "2.15.2",
"status": "affected",
"version": "2.15.0",
"versionType": "semver"
},
{
"lessThan": "2.14.6",
"status": "affected",
"version": "2.14.0",
"versionType": "semver"
},
{
"lessThan": "2.13.10",
"status": "affected",
"version": "2.13.0",
"versionType": "semver"
},
{
"lessThan": "2.12.14",
"status": "affected",
"version": "2.12.0",
"versionType": "semver"
},
{
"lessThan": "2.11.18",
"status": "affected",
"version": "2.11.0se",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.15.2",
"versionStartIncluding": "2.15.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.14.6",
"versionStartIncluding": "2.14.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.13.10",
"versionStartIncluding": "2.13.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.12.14",
"versionStartIncluding": "2.12.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.11.18",
"versionStartIncluding": "2.11.0se",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "stopvvar@proton.me"
}
],
"datePublic": "2026-09-28T15:53:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An unauthenticated update of public UI settings could be used by remote attackers to execute a stored cross-site scripting attack in the Rancher UI, in SUSE Rancher 2.15 before 2.15.2, 2.14 before 2.14.6, 2.13 before 2.13.10, 2.12 before 2.12.14 and 2.11 before 2.11.18."
}
],
"value": "An unauthenticated update of public UI settings could be used by remote attackers to execute a stored cross-site scripting attack in the Rancher UI, in SUSE Rancher 2.15 before 2.15.2, 2.14 before 2.14.6, 2.13 before 2.13.10, 2.12 before 2.12.14 and 2.11 before 2.11.18."
}
],
"impacts": [
{
"capecId": "CAPEC-104",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-104 Cross Zone Scripting"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-28T15:58:34.657Z",
"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
"shortName": "suse"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://github.com/rancher/rancher/security/advisories/GHSA-992f-xh8r-jg2f"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Unauthenticated update of public UI settings leading to stored cross-site scripting in Rancher",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
"assignerShortName": "suse",
"cveId": "CVE-2026-88804",
"datePublished": "2026-09-28T15:58:34.657Z",
"dateReserved": "2026-09-10T08:35:07.010Z",
"dateUpdated": "2026-09-28T18:02:56.882Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93540 (GCVE-0-2026-93540)
Vulnerability from nvd – Published: 2026-09-28 14:45 – Updated: 2026-09-28 16:22
VLAI
EPSS
VEX
Title
Fleet applies namespace labels and annotations without the bundle's service account privileges
Summary
A privilege mismatch was found in Fleet. When a bundle requested namespace labels or annotations through the namespaceLabels and namespaceAnnotations options, the resulting namespace metadata update was not subject to the same authorization as the rest of the bundle's deployment. As a result, a bundle could change labels and annotations on a target namespace even when the identity it was pinned to was not authorized to modify that namespace.
This affected SUSE Rancher Fleet 0.16 before 0.16.2, 0.15 before 0.15.7, 0.14 before 0.14.11, 0.13 before 0.13.16 and potentially older versions.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-28 15:25 UTC
CWE
- CWE-266 - Incorrect privilege assignment
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/rancher/fleet/security/advisor… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| SUSE | Rancher |
Affected:
0.16.0 , < 0.16.1
(semver)
Affected: 0.15.0 , < 0.15.7 (semver) Affected: 0.14.0 , < 0.14.11 (semver) Affected: 0.13.0 , < 0.13.16 (semver) cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:* cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:* cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:* cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:* |
Date Public
2026-09-28 14:28
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-93540",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-28T15:25:53.294940Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-28T16:22:25.780Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "Fleet",
"product": "Rancher",
"repo": "https://github.com/rancher/fleet/",
"vendor": "SUSE",
"versions": [
{
"lessThan": "0.16.1",
"status": "affected",
"version": "0.16.0",
"versionType": "semver"
},
{
"lessThan": "0.15.7",
"status": "affected",
"version": "0.15.0",
"versionType": "semver"
},
{
"lessThan": "0.14.11",
"status": "affected",
"version": "0.14.0",
"versionType": "semver"
},
{
"lessThan": "0.13.16",
"status": "affected",
"version": "0.13.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.16.1",
"versionStartIncluding": "0.16.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.15.7",
"versionStartIncluding": "0.15.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.14.11",
"versionStartIncluding": "0.14.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.13.16",
"versionStartIncluding": "0.13.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "g.mygenie@gmail.com"
}
],
"datePublic": "2026-09-28T14:28:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eA privilege mismatch was found in Fleet. When a bundle requested namespace labels or annotations through the \u003ccode\u003enamespaceLabels\u003c/code\u003e and \u003ccode\u003enamespaceAnnotations\u003c/code\u003e options, the resulting namespace metadata update was not subject to the same authorization as the rest of the bundle\u0027s deployment. As a result, a bundle could change labels and annotations on a target namespace even when the identity it was pinned to was not authorized to modify that namespace.\u003c/div\u003e\u003cdiv\u003eThis affected SUSE Rancher Fleet 0.16 before 0.16.2, 0.15 before 0.15.7, 0.14 before 0.14.11, 0.13 before 0.13.16 and potentially older versions.\u003c/div\u003e"
}
],
"value": "A privilege mismatch was found in Fleet. When a bundle requested namespace labels or annotations through the namespaceLabels and namespaceAnnotations options, the resulting namespace metadata update was not subject to the same authorization as the rest of the bundle\u0027s deployment. As a result, a bundle could change labels and annotations on a target namespace even when the identity it was pinned to was not authorized to modify that namespace.\n\nThis affected SUSE Rancher Fleet 0.16 before 0.16.2, 0.15 before 0.15.7, 0.14 before 0.14.11, 0.13 before 0.13.16 and potentially older versions."
}
],
"impacts": [
{
"capecId": "CAPEC-690",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-690 Metadata Spoofing"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "CWE-266 Incorrect privilege assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-28T14:45:42.336Z",
"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
"shortName": "suse"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://github.com/rancher/fleet/security/advisories/GHSA-m93g-8438-2cgg"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Fleet applies namespace labels and annotations without the bundle\u0027s service account privileges",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
"assignerShortName": "suse",
"cveId": "CVE-2026-93540",
"datePublished": "2026-09-28T14:45:42.336Z",
"dateReserved": "2026-09-18T09:08:10.294Z",
"dateUpdated": "2026-09-28T16:22:25.780Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93539 (GCVE-0-2026-93539)
Vulnerability from nvd – Published: 2026-09-28 14:19 – Updated: 2026-09-28 16:22
VLAI
EPSS
VEX
Title
Unauthenticated GitRepo Spec Mutation via Fleet Git Webhook Receiver
Summary
A vulnerability was discovered in Fleet's Git webhook receiver (the gitjob webhook service). When a webhook secret is not configured, incoming webhook requests are accepted without verification, and processing a request can change the spec.pollingInterval field of a matching GitRepo resource in any namespace. A caller with network access to the webhook service and no Kubernetes credentials can therefore alter GitRepo configuration outside
the namespaces they are authorized for. This only affects SUSE Rancher Fleet 0.16 before 0.16.2, older versions are not affected.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-28 14:59 UTC
CWE
- CWE-306 - Missing authentication for critical function
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/rancher/fleet/security/advisor… | vendor-advisory |
Impacted products
Date Public
2026-09-28 14:16
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-93539",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-28T14:59:38.674475Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-28T16:22:26.433Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "Fleet",
"product": "Rancher",
"repo": "https://github.com/rancher/fleet/",
"vendor": "SUSE",
"versions": [
{
"lessThan": "0.16.2",
"status": "affected",
"version": "0.16.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.16.2",
"versionStartIncluding": "0.16.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "https://github.com/Pig-Tail"
}
],
"datePublic": "2026-09-28T14:16:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A vulnerability was discovered in Fleet\u0027s Git webhook receiver (the \u003ccode\u003egitjob\u003c/code\u003e webhook service). When a webhook secret is not configured, incoming webhook requests are accepted without verification, and processing a request can change the \u003ccode\u003espec.pollingInterval\u003c/code\u003e field of a matching \u003ccode\u003eGitRepo\u003c/code\u003e resource in any namespace. A caller with network access to the webhook service and no Kubernetes credentials can therefore alter \u003ccode\u003eGitRepo\u003c/code\u003e configuration outside\u003cbr\u003e\nthe namespaces they are authorized for.\u0026nbsp; This only affects SUSE Rancher Fleet 0.16 before 0.16.2, older versions are not affected."
}
],
"value": "A vulnerability was discovered in Fleet\u0027s Git webhook receiver (the gitjob webhook service). When a webhook secret is not configured, incoming webhook requests are accepted without verification, and processing a request can change the spec.pollingInterval field of a matching GitRepo resource in any namespace. A caller with network access to the webhook service and no Kubernetes credentials can therefore alter GitRepo configuration outside\n\nthe namespaces they are authorized for.\u00a0 This only affects SUSE Rancher Fleet 0.16 before 0.16.2, older versions are not affected."
}
],
"impacts": [
{
"capecId": "CAPEC-176",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-176 Configuration/Environment Manipulation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing authentication for critical function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-28T14:19:55.071Z",
"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
"shortName": "suse"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://github.com/rancher/fleet/security/advisories/GHSA-8vfv-33cg-g75q"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Unauthenticated GitRepo Spec Mutation via Fleet Git Webhook Receiver",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
"assignerShortName": "suse",
"cveId": "CVE-2026-93539",
"datePublished": "2026-09-28T14:19:55.071Z",
"dateReserved": "2026-09-18T09:08:10.294Z",
"dateUpdated": "2026-09-28T16:22:26.433Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93538 (GCVE-0-2026-93538)
Vulnerability from nvd – Published: 2026-09-28 14:10 – Updated: 2026-09-28 16:22
VLAI
EPSS
VEX
Title
Cross-tenant BundleDeployment and Secret disclosure via spoofed cluster labels during agent-initiated registration in Fleet
Summary
A cross-tenant authorization issue was discovered in SUSE Rancher Fleet. During agent-initiated cluster registration, cluster labels supplied by the registering agent, including labels in the reserved management.cattle.io/ namespace such as the cluster display name label, were applied to the resulting upstream Cluster object. Because Fleet resolves GitRepo and Bundle targets from those cluster labels, a party able to register a cluster into a Fleet workspace namespace shared with other tenants could cause its own cluster to satisfy targeting rules that administrators intended for a different cluster.
This affects SUSE Rancher Fleet 0.16 before 0.16.1, 0.15 before 0.15.6, 0.14 before 0.14.10, 0.13 before 0.13.15, 0.12 before 0.12.19 and older versions.
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-28 15:46 UTC
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/rancher/fleet/security/advisor… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| SUSE | Rancher |
Affected:
0.16.0 , < 0.16.1
(semver)
Affected: 0.15.0 , < 0.15.6 (semver) Affected: 0.14.0 , < 0.14.10 (semver) Affected: 0.13.0 , < 0.13.15 (semver) Affected: 0.12.0 , < 0.12.19 (semver) cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:* cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:* cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:* cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:* cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:* |
Date Public
2026-09-28 14:05
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-93538",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-28T15:46:41.479078Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-28T16:22:26.562Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "Fleet",
"product": "Rancher",
"repo": "https://github.com/rancher/fleet/",
"vendor": "SUSE",
"versions": [
{
"lessThan": "0.16.1",
"status": "affected",
"version": "0.16.0",
"versionType": "semver"
},
{
"lessThan": "0.15.6",
"status": "affected",
"version": "0.15.0",
"versionType": "semver"
},
{
"lessThan": "0.14.10",
"status": "affected",
"version": "0.14.0",
"versionType": "semver"
},
{
"lessThan": "0.13.15",
"status": "affected",
"version": "0.13.0",
"versionType": "semver"
},
{
"lessThan": "0.12.19",
"status": "affected",
"version": "0.12.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.16.1",
"versionStartIncluding": "0.16.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.15.6",
"versionStartIncluding": "0.15.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.14.10",
"versionStartIncluding": "0.14.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.13.15",
"versionStartIncluding": "0.13.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.12.19",
"versionStartIncluding": "0.12.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "https://github.com/Pig-Tail"
}
],
"datePublic": "2026-09-28T14:05:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A cross-tenant authorization issue was discovered in SUSE Rancher Fleet. During agent-initiated\u0026nbsp;cluster registration, cluster labels supplied by the registering agent, including labels in the reserved \u003ccode\u003emanagement.cattle.io/\u003c/code\u003e namespace such as the cluster display name label, were applied to the resulting upstream \u003ccode\u003eCluster\u003c/code\u003e object. Because Fleet resolves \u003ccode\u003eGitRepo\u003c/code\u003e and \u003ccode\u003eBundle\u003c/code\u003e targets from those cluster labels, a party able to register a cluster into a Fleet workspace namespace shared with other tenants could cause its own cluster to satisfy targeting rules that administrators intended for a different cluster.\u003cbr\u003eThis affects SUSE Rancher Fleet 0.16 before 0.16.1, 0.15 before 0.15.6, 0.14 before 0.14.10, 0.13 before 0.13.15, 0.12 before 0.12.19 and older versions."
}
],
"value": "A cross-tenant authorization issue was discovered in SUSE Rancher Fleet. During agent-initiated\u00a0cluster registration, cluster labels supplied by the registering agent, including labels in the reserved management.cattle.io/ namespace such as the cluster display name label, were applied to the resulting upstream Cluster object. Because Fleet resolves GitRepo and Bundle targets from those cluster labels, a party able to register a cluster into a Fleet workspace namespace shared with other tenants could cause its own cluster to satisfy targeting rules that administrators intended for a different cluster.\nThis affects SUSE Rancher Fleet 0.16 before 0.16.1, 0.15 before 0.15.6, 0.14 before 0.14.10, 0.13 before 0.13.15, 0.12 before 0.12.19 and older versions."
}
],
"impacts": [
{
"capecId": "CAPEC-122",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-122 Privilege Abuse"
}
]
},
{
"capecId": "CAPEC-195",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-195 Principal Spoof"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-290",
"description": "CWE-290 Authentication bypass by spoofing",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization bypass through User-Controlled key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-28T14:10:21.720Z",
"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
"shortName": "suse"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://github.com/rancher/fleet/security/advisories/GHSA-h9p5-fp5h-qpqr"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Cross-tenant BundleDeployment and Secret disclosure via spoofed cluster labels during agent-initiated registration in Fleet",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
"assignerShortName": "suse",
"cveId": "CVE-2026-93538",
"datePublished": "2026-09-28T14:10:21.720Z",
"dateReserved": "2026-09-18T09:08:10.294Z",
"dateUpdated": "2026-09-28T16:22:26.562Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93537 (GCVE-0-2026-93537)
Vulnerability from nvd – Published: 2026-09-28 13:29 – Updated: 2026-09-28 17:54
VLAI
EPSS
VEX
Title
Path traversal in Fleet Helm valuesFiles allows disclosure of files outside the bundle directory
Summary
A user who can supply bundle content to a repository referenced by a GitRepo resource, for example through Git push access, or through permission to create or modify a GitRepo, can cause SUSE Rancher Fleet to read files from the filesystem of the environment that processes the bundle and include their contents in the generated Bundle resource. This can expose configuration or credential material that the user has no Kubernetes RBAC permission to read, including Helm registry credentials made available to the bundle-processing job when per-path Helm credentials are configured.
This affects Fleet 0.16 before 0.16.2, 0.15 before 0.15.7, 0.14 before 0.14.11, 0.13 before 0.13.16, 0.12 before 0.12.20 and potentially older unsupported versions.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-28 17:54 UTC
CWE
- CWE-23 - Relative path traversal
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/rancher/fleet/security/advisor… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| SUSE | Rancher |
Affected:
0.16.0 , < 0.16.2
(semver)
Affected: 0.15.0 , < 0.15.7 (semver) Affected: 0.14.0 , < 0.14.11 (semver) Affected: 0.13.0 , < 0.13.16 (semver) Affected: 0.12.0 , < 0.12.20 (semver) cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:* cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:* cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:* cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:* cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:* |
Date Public
2026-09-28 12:15
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-93537",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-28T17:54:00.943037Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-28T17:54:22.754Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "Fleet",
"product": "Rancher",
"repo": "https://github.com/rancher/fleet/",
"vendor": "SUSE",
"versions": [
{
"lessThan": "0.16.2",
"status": "affected",
"version": "0.16.0",
"versionType": "semver"
},
{
"lessThan": "0.15.7",
"status": "affected",
"version": "0.15.0",
"versionType": "semver"
},
{
"lessThan": "0.14.11",
"status": "affected",
"version": "0.14.0",
"versionType": "semver"
},
{
"lessThan": "0.13.16",
"status": "affected",
"version": "0.13.0",
"versionType": "semver"
},
{
"lessThan": "0.12.20",
"status": "affected",
"version": "0.12.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.16.2",
"versionStartIncluding": "0.16.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.15.7",
"versionStartIncluding": "0.15.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.14.11",
"versionStartIncluding": "0.14.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.13.16",
"versionStartIncluding": "0.13.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.12.20",
"versionStartIncluding": "0.12.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "https://github.com/Pig-Tail"
}
],
"datePublic": "2026-09-28T12:15:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A user who can supply bundle content to a repository referenced by a \u003ccode\u003eGitRepo\u003c/code\u003e resource, for example through Git push access, or through permission to create or modify a \u003ccode\u003eGitRepo\u003c/code\u003e, can cause SUSE Rancher Fleet to read files from the filesystem of the environment that processes the bundle and include their contents in the generated \u003ccode\u003eBundle\u003c/code\u003e resource. This can expose configuration or credential material that the user has no Kubernetes RBAC permission to read, including Helm registry credentials made available to the bundle-processing job when per-path Helm credentials are configured.\u003cbr\u003eThis affects Fleet 0.16 before 0.16.2, 0.15 before 0.15.7, 0.14 before 0.14.11, 0.13 before 0.13.16, 0.12 before 0.12.20 and potentially older unsupported versions."
}
],
"value": "A user who can supply bundle content to a repository referenced by a GitRepo resource, for example through Git push access, or through permission to create or modify a GitRepo, can cause SUSE Rancher Fleet to read files from the filesystem of the environment that processes the bundle and include their contents in the generated Bundle resource. This can expose configuration or credential material that the user has no Kubernetes RBAC permission to read, including Helm registry credentials made available to the bundle-processing job when per-path Helm credentials are configured.\nThis affects Fleet 0.16 before 0.16.2, 0.15 before 0.15.7, 0.14 before 0.14.11, 0.13 before 0.13.16, 0.12 before 0.12.20 and potentially older unsupported versions."
}
],
"impacts": [
{
"capecId": "CAPEC-122",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-122 Privilege Abuse"
}
]
},
{
"capecId": "CAPEC-180",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-180"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-23",
"description": "CWE-23 Relative path traversal",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-28T13:29:10.263Z",
"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
"shortName": "suse"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://github.com/rancher/fleet/security/advisories/GHSA-wpfm-r97v-3j4h"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Path traversal in Fleet Helm valuesFiles allows disclosure of files outside the bundle directory",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
"assignerShortName": "suse",
"cveId": "CVE-2026-93537",
"datePublished": "2026-09-28T13:29:10.263Z",
"dateReserved": "2026-09-18T09:08:10.294Z",
"dateUpdated": "2026-09-28T17:54:22.754Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-75035 (GCVE-0-2026-75035)
Vulnerability from nvd – Published: 2026-09-03 15:07 – Updated: 2026-09-05 01:25
VLAI
EPSS
VEX
Title
Rancher: ext.cattle.io/v1 Token store: cross-user token disclosure via label-selector scoping bypass
Summary
A flaw was found in Rancher Manager. When a non-administrative caller supplied a label selector naming a different user, the ext.cattle.io/v1 Token store dropped its internal owner filter instead of returning an empty result. Any authenticated user could therefore list and watch every other user's tokens, disclosing token metadata and the stored salted hash of the bearer token.
This issue affects Rancher: before 2.15.1.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-05 01:25 UTC
CWE
- CWE-639 - Authorization bypass through User-Controlled key
Assigner
References
1 reference
Date Public
2026-08-31 15:01
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-75035",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-05T01:25:28.809972Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-05T01:25:40.696Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Rancher",
"repo": "https://github.com/rancher/rancher",
"vendor": "SUSE",
"versions": [
{
"lessThan": "2.15.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"datePublic": "2026-08-31T15:01:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA flaw was found in Rancher Manager. When a non-administrative caller supplied a label selector naming a different user, the ext.cattle.io/v1 Token store dropped its internal owner filter instead of returning an empty result. Any authenticated user could therefore list and watch every other user\u0027s tokens, disclosing token metadata and the stored salted hash of the bearer token.\u003c/p\u003e\u003cp\u003eThis issue affects Rancher: before 2.15.1.\u003c/p\u003e"
}
],
"value": "A flaw was found in Rancher Manager. When a non-administrative caller supplied a label selector naming a different user, the ext.cattle.io/v1 Token store dropped its internal owner filter instead of returning an empty result. Any authenticated user could therefore list and watch every other user\u0027s tokens, disclosing token metadata and the stored salted hash of the bearer token.\n\n\n\nThis issue affects Rancher: before 2.15.1."
}
],
"impacts": [
{
"capecId": "CAPEC-77",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-77 Manipulating User-Controlled Variables"
}
]
},
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
},
{
"capecId": "CAPEC-116",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-116 Excavation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization bypass through User-Controlled key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T15:07:11.685Z",
"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
"shortName": "suse"
},
"references": [
{
"url": "https://github.com/rancher/rancher/releases/tag/v2.15.1"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Rancher: ext.cattle.io/v1 Token store: cross-user token disclosure via label-selector scoping bypass",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
"assignerShortName": "suse",
"cveId": "CVE-2026-75035",
"datePublished": "2026-09-03T15:07:11.685Z",
"dateReserved": "2026-08-17T15:22:54.444Z",
"dateUpdated": "2026-09-05T01:25:40.696Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-75034 (GCVE-0-2026-75034)
Vulnerability from nvd – Published: 2026-09-03 15:01 – Updated: 2026-09-04 03:56
VLAI
EPSS
VEX
Title
Rancher: SAML Assertion Replay
Summary
A flaw was found in Rancher Manager. The SAML assertion replay protection introduced by the fix for CVE-2026-44946 recorded consumed assertion IDs in a per-process cache, so each replica only detected replays that reached the same pod. In a high-availability deployment, an attacker holding a captured assertion could replay it once against every other replica to obtain additional authenticated sessions as the victim.
This issue affects Rancher: before 2.15.1.
Severity
7.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-03 00:00 UTC
CWE
- CWE-294 - Authentication bypass by capture-replay
Assigner
References
1 reference
Date Public
2026-08-31 14:58
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-75034",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-03T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T03:56:03.896Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Rancher",
"repo": "https://github.com/rancher/rancher",
"vendor": "SUSE",
"versions": [
{
"lessThan": "2.15.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wade Sparks"
}
],
"datePublic": "2026-08-31T14:58:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A flaw was found in Rancher Manager. The SAML assertion replay protection introduced by the fix for CVE-2026-44946 recorded consumed assertion IDs in a per-process cache, so each replica only detected replays that reached the same pod. In a high-availability deployment, an attacker holding a captured assertion could replay it once against every other replica to obtain additional authenticated sessions as the victim.\u003cbr\u003e\u003cp\u003eThis issue affects Rancher: before 2.15.1.\u003c/p\u003e"
}
],
"value": "A flaw was found in Rancher Manager. The SAML assertion replay protection introduced by the fix for CVE-2026-44946 recorded consumed assertion IDs in a per-process cache, so each replica only detected replays that reached the same pod. In a high-availability deployment, an attacker holding a captured assertion could replay it once against every other replica to obtain additional authenticated sessions as the victim.\n\n\nThis issue affects Rancher: before 2.15.1."
}
],
"impacts": [
{
"capecId": "CAPEC-60",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-60 Reusing Session IDs (aka Session Replay)"
}
]
},
{
"capecId": "CAPEC-94",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-94 Adversary in the Middle (AiTM)"
}
]
},
{
"capecId": "CAPEC-593",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-593 Session Hijacking"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-294",
"description": "CWE-294 Authentication bypass by capture-replay",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T15:01:16.635Z",
"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
"shortName": "suse"
},
"references": [
{
"url": "https://github.com/rancher/rancher/releases/tag/v2.15.1"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Rancher: SAML Assertion Replay",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
"assignerShortName": "suse",
"cveId": "CVE-2026-75034",
"datePublished": "2026-09-03T15:01:16.635Z",
"dateReserved": "2026-08-17T15:22:54.444Z",
"dateUpdated": "2026-09-04T03:56:03.896Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-75033 (GCVE-0-2026-75033)
Vulnerability from nvd – Published: 2026-09-03 14:57 – Updated: 2026-09-03 15:13
VLAI
EPSS
VEX
Title
Rancher: Cross-Cluster Secret Leakage via Namespace projectId Annotation Spoofing
Summary
A flaw was found in Rancher Manager. Project Secrets were propagated into a namespace based only on its `field.cattle.io/projectId` annotation, without verifying that the referenced project belonged to the same downstream cluster. A user able to create namespaces on one cluster could set the annotation to a project ID from another cluster and have that project's secrets copied into a namespace under their control.
This issue affects Rancher: before 2.15.1.
Severity
7.7 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-03 15:13 UTC
CWE
- CWE-639 - Authorization bypass through User-Controlled key
Assigner
References
1 reference
Date Public
2026-08-31 14:52
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-75033",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-03T15:13:38.725376Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T15:13:54.624Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Rancher",
"repo": "https://github.com/rancher/rancher",
"vendor": "SUSE",
"versions": [
{
"lessThan": "2.15.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Alex Seymour"
}
],
"datePublic": "2026-08-31T14:52:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A flaw was found in Rancher Manager. Project Secrets were propagated into a namespace based only on its `field.cattle.io/projectId` annotation, without verifying that the referenced project belonged to the same downstream cluster. A user able to create namespaces on one cluster could set the annotation to a project ID from another cluster and have that project\u0027s secrets copied into a namespace under their control.\u003cbr\u003e\u003cp\u003eThis issue affects Rancher: before 2.15.1.\u003c/p\u003e"
}
],
"value": "A flaw was found in Rancher Manager. Project Secrets were propagated into a namespace based only on its `field.cattle.io/projectId` annotation, without verifying that the referenced project belonged to the same downstream cluster. A user able to create namespaces on one cluster could set the annotation to a project ID from another cluster and have that project\u0027s secrets copied into a namespace under their control.\n\n\nThis issue affects Rancher: before 2.15.1."
}
],
"impacts": [
{
"capecId": "CAPEC-21",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-21 Exploitation of Trusted Identifiers"
}
]
},
{
"capecId": "CAPEC-116",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-116 Excavation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization bypass through User-Controlled key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T14:57:34.334Z",
"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
"shortName": "suse"
},
"references": [
{
"url": "https://github.com/rancher/rancher/releases/tag/v2.15.1"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Rancher: Cross-Cluster Secret Leakage via Namespace projectId Annotation Spoofing",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
"assignerShortName": "suse",
"cveId": "CVE-2026-75033",
"datePublished": "2026-09-03T14:57:34.334Z",
"dateReserved": "2026-08-17T15:22:54.443Z",
"dateUpdated": "2026-09-03T15:13:54.624Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-71404 (GCVE-0-2026-71404)
Vulnerability from nvd – Published: 2026-09-03 14:51 – Updated: 2026-09-03 15:07
VLAI
EPSS
VEX
Title
Rancher: Ownership-less ClusterRole overwrite via attacker-controlled cr-name annotation on GlobalRole
Summary
A flaw was found in Rancher Manager. The GlobalRole controller derived the target ClusterRole name from the user-settable `authz.management.cattle.io/cr-name` annotation and overwrote that object's rules without verifying ownership. A user with delegated GlobalRole create or update permission could point the annotation at any existing ClusterRole, such as `cluster-admin`, and revoke the permissions of every principal bound to it. The change persists after the malicious GlobalRole is deleted.
This issue affects Rancher: before 2.15.1.
Severity
8.7 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-03 15:06 UTC
CWE
- CWE-639 - Authorization bypass through User-Controlled key
Assigner
References
2 references
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-71404",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-03T15:06:03.098792Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T15:07:12.467Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Rancher",
"repo": "https://github.com/rancher/rancher",
"vendor": "SUSE",
"versions": [
{
"lessThan": "2.15.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "https://github.com/Pig-Tail"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A flaw was found in Rancher Manager. The GlobalRole controller derived the target ClusterRole name from the user-settable `authz.management.cattle.io/cr-name` annotation and overwrote that object\u0027s rules without verifying ownership. A user with delegated GlobalRole create or update permission could point the annotation at any existing ClusterRole, such as `cluster-admin`, and revoke the permissions of every principal bound to it. The change persists after the malicious GlobalRole is deleted.\u003cbr\u003e\u003cp\u003eThis issue affects Rancher: before 2.15.1.\u003c/p\u003e"
}
],
"value": "A flaw was found in Rancher Manager. The GlobalRole controller derived the target ClusterRole name from the user-settable `authz.management.cattle.io/cr-name` annotation and overwrote that object\u0027s rules without verifying ownership. A user with delegated GlobalRole create or update permission could point the annotation at any existing ClusterRole, such as `cluster-admin`, and revoke the permissions of every principal bound to it. The change persists after the malicious GlobalRole is deleted.\n\n\nThis issue affects Rancher: before 2.15.1."
}
],
"impacts": [
{
"capecId": "CAPEC-176",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-176 Configuration/Environment Manipulation"
}
]
},
{
"capecId": "CAPEC-77",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-77 Manipulating User-Controlled Variables"
}
]
},
{
"capecId": "CAPEC-240",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-240 Resource Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization bypass through User-Controlled key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T14:51:44.678Z",
"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
"shortName": "suse"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/rancher/rancher/pull/56642"
},
{
"tags": [
"patch"
],
"url": "https://github.com/rancher/rancher/pull/56593"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Rancher: Ownership-less ClusterRole overwrite via attacker-controlled cr-name annotation on GlobalRole",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
"assignerShortName": "suse",
"cveId": "CVE-2026-71404",
"datePublished": "2026-09-03T14:51:44.678Z",
"dateReserved": "2026-08-06T11:38:54.896Z",
"dateUpdated": "2026-09-03T15:07:12.467Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-71403 (GCVE-0-2026-71403)
Vulnerability from nvd – Published: 2026-09-03 14:45 – Updated: 2026-09-04 03:55
VLAI
EPSS
VEX
Title
Rancher: Identity-field mutation in /v3/users allows account hijack via principal rebind
Summary
A flaw was found in Rancher Manager. The /v3/users update path did not enforce immutability of a User resource's `username` and `principalIds` fields. A user holding the `update` verb on `users.management.cattle.io` could inject a foreign identity provider principal into any account, so that the next login by the owner of that principal was bound to the victim's account and inherited its role bindings.
This issue affects Rancher: before 2.15.1.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-03 00:00 UTC
CWE
- CWE-639 - Authorization bypass through User-Controlled key
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/rancher/rancher/pull/56616 | patch |
Date Public
2026-08-31 14:37
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-71403",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-03T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T03:55:59.443Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"Manager"
],
"product": "Rancher",
"repo": "https://github.com/rancher/rancher",
"vendor": "SUSE",
"versions": [
{
"lessThan": "2.15.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Andrej Tom\u010di"
}
],
"datePublic": "2026-08-31T14:37:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A flaw was found in Rancher Manager. The /v3/users update path did not enforce immutability of a User resource\u0027s `username` and `principalIds` fields. A user holding the `update` verb on `users.management.cattle.io` could inject a foreign identity provider principal into any account, so that the next login by the owner of that principal was bound to the victim\u0027s account and inherited its role bindings.\u003cbr\u003e\u003cp\u003eThis issue affects Rancher: before 2.15.1.\u003c/p\u003e"
}
],
"value": "A flaw was found in Rancher Manager. The /v3/users update path did not enforce immutability of a User resource\u0027s `username` and `principalIds` fields. A user holding the `update` verb on `users.management.cattle.io` could inject a foreign identity provider principal into any account, so that the next login by the owner of that principal was bound to the victim\u0027s account and inherited its role bindings.\n\n\nThis issue affects Rancher: before 2.15.1."
}
],
"impacts": [
{
"capecId": "CAPEC-21",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-21 Exploitation of Trusted Identifiers"
}
]
},
{
"capecId": "CAPEC-151",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-151 Identity Spoofing"
}
]
},
{
"capecId": "CAPEC-593",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-593 Session Hijacking"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization bypass through User-Controlled key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T14:45:37.468Z",
"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
"shortName": "suse"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/rancher/rancher/pull/56616"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Rancher: Identity-field mutation in /v3/users allows account hijack via principal rebind",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
"assignerShortName": "suse",
"cveId": "CVE-2026-71403",
"datePublished": "2026-09-03T14:45:37.468Z",
"dateReserved": "2026-08-06T11:38:54.896Z",
"dateUpdated": "2026-09-04T03:55:59.443Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-44945 (GCVE-0-2026-44945)
Vulnerability from nvd – Published: 2026-08-05 10:00 – Updated: 2026-08-06 03:55
VLAI
EPSS
VEX
Title
Cross-Cluster Impersonation Confused-Deputy Privilege Escalation
Summary
A privilege escalation vulnerability exists in Rancher's impersonation middleware (pkg/auth/requests/impersonate.go). An authenticated Rancher user with the default user
global role can gain full administrative access to the Rancher control
plane and transitively to all downstream clusters it manages.
This issue affects Rancher: from 2.11.0 before 2.11.16, from 2.12.0 before 2.12.12, from 2.13.0 before 2.13.8, and from 2.14.0 before 2.14.2.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-05 00:00 UTC
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/rancher/rancher/pull/55983 | patch |
| https://github.com/rancher/rancher/security/advis… | vendor-advisory |
| https://bugzilla.suse.com/show_bug.cgi?id=CVE-202… | issue-tracking |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-44945",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-05T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T03:55:24.710Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "Rancher",
"product": "Rancher",
"repo": "https://github.com/rancher/rancher",
"vendor": "SUSE",
"versions": [
{
"changes": [
{
"at": "2.11.16",
"status": "unaffected"
}
],
"lessThan": "2.11.16",
"status": "affected",
"version": "2.11.0",
"versionType": "semver"
},
{
"changes": [
{
"at": "2.12.12",
"status": "unaffected"
}
],
"lessThan": "2.12.12",
"status": "affected",
"version": "2.12.0",
"versionType": "semver"
},
{
"changes": [
{
"at": "2.13.8",
"status": "unaffected"
}
],
"lessThan": "2.13.8",
"status": "affected",
"version": "2.13.0",
"versionType": "semver"
},
{
"changes": [
{
"at": "2.14.4",
"status": "unaffected"
}
],
"lessThan": "2.14.2",
"status": "affected",
"version": "2.14.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This vulnerability was discovered and reported by @BenTheCyberOne."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A privilege escalation vulnerability exists in Rancher\u0027s impersonation middleware (\u003ccode\u003epkg/auth/requests/impersonate.go\u003c/code\u003e). An authenticated Rancher user with the default \u003ccode\u003euser\u003c/code\u003e\n global role can gain full administrative access to the Rancher control \nplane and transitively to all downstream clusters it manages.\u003cp\u003eThis issue affects Rancher: from 2.11.0 before 2.11.16, from 2.12.0 before 2.12.12, from 2.13.0 before 2.13.8, and from 2.14.0 before 2.14.2.\u003c/p\u003e"
}
],
"value": "A privilege escalation vulnerability exists in Rancher\u0027s impersonation middleware (pkg/auth/requests/impersonate.go). An authenticated Rancher user with the default user\n global role can gain full administrative access to the Rancher control \nplane and transitively to all downstream clusters it manages.\n\nThis issue affects Rancher: from 2.11.0 before 2.11.16, from 2.12.0 before 2.12.12, from 2.13.0 before 2.13.8, and from 2.14.0 before 2.14.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-441",
"description": "CWE-441: Unintended Proxy or Intermediary (\u0027Confused Deputy\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-497",
"description": "CWE-497 Exposure of sensitive system information to an unauthorized control sphere",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T10:00:04.286Z",
"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
"shortName": "suse"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/rancher/rancher/pull/55983"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://github.com/rancher/rancher/security/advisories/GHSA-v584-7w32-jwpq"
},
{
"tags": [
"issue-tracking"
],
"url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-44945"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Cross-Cluster Impersonation Confused-Deputy Privilege Escalation",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
"assignerShortName": "suse",
"cveId": "CVE-2026-44945",
"datePublished": "2026-08-05T10:00:04.286Z",
"dateReserved": "2026-05-08T12:29:48.968Z",
"dateUpdated": "2026-08-06T03:55:24.710Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59675 (GCVE-0-2026-59675)
Vulnerability from nvd – Published: 2026-08-05 07:49 – Updated: 2026-08-05 13:15
VLAI
EPSS
VEX
Title
Rancher Audit-Log Middleware Unauthenticated Memory Exhaustion Denial of Service
Summary
When API audit logging is enabled, the middleware reads the entire HTTP request body into memory without enforcing a size limit on login endpoints. Because the audit middleware is positioned earlier in the handler chain than Rancher's APIBodyLimitingHandler, the body-size cap (default 1 MiB) is bypassed for requests that pass through the audit copyReqBody path. An unauthenticated attacker can send arbitrarily large request bodies to the public login endpoints, causing the Rancher Manager server process to allocate memory proportional to the supplied body size. With just a few concurrent connections, this can exhaust available memory and terminate the Rancher Manager plane process, making the Rancher API and UI unavailable and interrupting management of all downstream clusters.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-05 13:14 UTC
CWE
- CWE-770 - Uncontrolled Resource Consumption / Input Handling
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59675",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-05T13:14:41.312459Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T13:15:22.855Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "Rancher",
"product": "Rancher",
"vendor": "SUSE",
"versions": [
{
"lessThan": "2.14.4",
"status": "affected",
"version": "2.14.0",
"versionType": "semver"
},
{
"lessThan": "2.13.8",
"status": "affected",
"version": "2.13.0",
"versionType": "semver"
},
{
"lessThan": "2.12.12",
"status": "affected",
"version": "2.12.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This vulnerability was discovered and reported by securityraven@proton.me"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cspan\u003eWhen API audit logging is enabled, the middleware reads the entire HTTP request body into memory without enforcing a size limit on login endpoints. Because the audit middleware is positioned earlier in the handler chain than Rancher\u0027s APIBodyLimitingHandler, the body-size cap (default 1 MiB) is bypassed for requests that pass through the audit copyReqBody path. An unauthenticated attacker can send arbitrarily large request bodies to the public login endpoints, causing the Rancher Manager server process to allocate memory proportional to the supplied body size. With just a few concurrent connections, this can exhaust available memory and terminate the Rancher Manager plane process, making the Rancher API and UI unavailable and interrupting management of all downstream clusters.\u003c/span\u003e\u003c/p\u003e"
}
],
"value": "When API audit logging is enabled, the middleware reads the entire HTTP request body into memory without enforcing a size limit on login endpoints. Because the audit middleware is positioned earlier in the handler chain than Rancher\u0027s APIBodyLimitingHandler, the body-size cap (default 1 MiB) is bypassed for requests that pass through the audit copyReqBody path. An unauthenticated attacker can send arbitrarily large request bodies to the public login endpoints, causing the Rancher Manager server process to allocate memory proportional to the supplied body size. With just a few concurrent connections, this can exhaust available memory and terminate the Rancher Manager plane process, making the Rancher API and UI unavailable and interrupting management of all downstream clusters."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Uncontrolled Resource Consumption / Input Handling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T07:49:11.592Z",
"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
"shortName": "suse"
},
"references": [
{
"url": "https://github.com/rancher/rancher/security/advisories/GHSA-g4f6-44g4-23xm"
},
{
"url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-59675"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Rancher Audit-Log Middleware Unauthenticated Memory Exhaustion Denial of Service",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
"assignerShortName": "suse",
"cveId": "CVE-2026-59675",
"datePublished": "2026-08-05T07:49:11.592Z",
"dateReserved": "2026-07-06T11:59:28.118Z",
"dateUpdated": "2026-08-05T13:15:22.855Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55998 (GCVE-0-2026-55998)
Vulnerability from nvd – Published: 2026-08-05 07:51 – Updated: 2026-08-05 13:13
VLAI
EPSS
VEX
Title
Cluster Existence Oracle via Unauthenticated Import Endpoint
Summary
The endpoint /v3/import/{token}_{clusterId}.yaml retrieves the cluster object before validating the token. When a valid cluster ID references a cluster that has private registry secrets configured, a nil pointer dereference in pkg/systemtemplate/private_registry.go causes the request to return HTTP 502 Bad Gateway. For cluster IDs that do not exist, the endpoint returns HTTP 200. This observable difference in response codes constitutes a reliable enumeration oracle.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-05 13:11 UTC
CWE
- CWE-204 - Observable response discrepancy
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55998",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-05T13:11:15.281747Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T13:13:02.031Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "Rancher",
"product": "Rancher",
"vendor": "SUSE",
"versions": [
{
"lessThan": "2.14.4",
"status": "affected",
"version": "2.14.0",
"versionType": "semver"
},
{
"lessThan": "2.13.8",
"status": "affected",
"version": "2.13.0",
"versionType": "semver"
},
{
"lessThan": "2.12.12",
"status": "affected",
"version": "2.12.0",
"versionType": "semver"
},
{
"lessThan": "2.11.16",
"status": "affected",
"version": "2.11.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This vulnerability was discovered and reported by Michael Wollner (@ibonok) from Deutsche Telekom AG."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cspan\u003eThe endpoint /v3/import/{token}_{clusterId}.yaml retrieves the cluster object before validating the token. When a valid cluster ID references a cluster that has private registry secrets configured, a nil pointer dereference in pkg/systemtemplate/private_registry.go causes the request to return HTTP 502 Bad Gateway. For cluster IDs that do not exist, the endpoint returns HTTP 200. This observable difference in response codes constitutes a reliable enumeration oracle.\u003c/span\u003e\u003c/p\u003e"
}
],
"value": "The endpoint /v3/import/{token}_{clusterId}.yaml retrieves the cluster object before validating the token. When a valid cluster ID references a cluster that has private registry secrets configured, a nil pointer dereference in pkg/systemtemplate/private_registry.go causes the request to return HTTP 502 Bad Gateway. For cluster IDs that do not exist, the endpoint returns HTTP 200. This observable difference in response codes constitutes a reliable enumeration oracle."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-204",
"description": "CWE-204 Observable response discrepancy",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T07:51:21.731Z",
"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
"shortName": "suse"
},
"references": [
{
"url": "https://github.com/rancher/rancher/security/advisories/GHSA-23h9-rr79-r3gh"
},
{
"url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-55998"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Cluster Existence Oracle via Unauthenticated Import Endpoint",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
"assignerShortName": "suse",
"cveId": "CVE-2026-55998",
"datePublished": "2026-08-05T07:51:21.731Z",
"dateReserved": "2026-06-18T09:26:55.988Z",
"dateUpdated": "2026-08-05T13:13:02.031Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55996 (GCVE-0-2026-55996)
Vulnerability from nvd – Published: 2026-08-05 07:46 – Updated: 2026-08-05 19:05
VLAI
EPSS
VEX
Title
Unauthenticated Denial-of-Service via TLS SAN Stuffing in Rancher and cattle-cluster-agent
Summary
A denial-of-service vulnerability was identified in multiple TLS listeners in Rancher. Both the cattle-cluster-agent component running in downstream clusters and the Rancher server itself use the dynamiclistener library to serve TLS traffic. Without an effective CN filter configured, dynamiclistener automatically appended to each serving certificate any hostname presented via Server Name Indication (SNI) in incoming TLS requests.
An unauthenticated attacker with network access within the affected cluster could send a large number of TLS requests with distinct hostnames, causing the serving certificate to accumulate an unbounded number of Subject Alternative Names (SANs). Eventually, the certificate grows large enough that TLS handshakes fail with an excessive message size error, causing a denial of service on the affected listeners.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-05 13:40 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55996",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-05T13:40:18.178968Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T19:05:26.627Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "Rancher",
"product": "Rancher",
"vendor": "SUSE",
"versions": [
{
"lessThan": "2.11.16",
"status": "affected",
"version": "2.11.0",
"versionType": "semver"
},
{
"lessThan": "2.12.12",
"status": "affected",
"version": "2.12.0",
"versionType": "semver"
},
{
"lessThan": "2.13.8",
"status": "affected",
"version": "2.13.0",
"versionType": "semver"
},
{
"lessThan": "2.14.4",
"status": "affected",
"version": "2.14.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cspan\u003eA denial-of-service vulnerability was identified in multiple TLS listeners in Rancher. Both the cattle-cluster-agent component running in downstream clusters and the Rancher server itself use the dynamiclistener library to serve TLS traffic. Without an effective CN filter configured, dynamiclistener automatically appended to each serving certificate any hostname presented via Server Name Indication (SNI) in incoming TLS requests.\u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003cspan\u003eAn unauthenticated attacker with network access within the affected cluster could send a large number of TLS requests with distinct hostnames, causing the serving certificate to accumulate an unbounded number of Subject Alternative Names (SANs). Eventually, the certificate grows large enough that TLS handshakes fail with an excessive message size error, causing a denial of service on the affected listeners.\u003c/span\u003e\u003c/p\u003e"
}
],
"value": "A denial-of-service vulnerability was identified in multiple TLS listeners in Rancher. Both the cattle-cluster-agent component running in downstream clusters and the Rancher server itself use the dynamiclistener library to serve TLS traffic. Without an effective CN filter configured, dynamiclistener automatically appended to each serving certificate any hostname presented via Server Name Indication (SNI) in incoming TLS requests.\n\n\n\nAn unauthenticated attacker with network access within the affected cluster could send a large number of TLS requests with distinct hostnames, causing the serving certificate to accumulate an unbounded number of Subject Alternative Names (SANs). Eventually, the certificate grows large enough that TLS handshakes fail with an excessive message size error, causing a denial of service on the affected listeners."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T07:46:43.831Z",
"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
"shortName": "suse"
},
"references": [
{
"url": "https://github.com/rancher/rancher/security/advisories/GHSA-9jxv-832x-45q9"
},
{
"url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-55996"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Unauthenticated Denial-of-Service via TLS SAN Stuffing in Rancher and cattle-cluster-agent",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
"assignerShortName": "suse",
"cveId": "CVE-2026-55996",
"datePublished": "2026-08-05T07:46:43.831Z",
"dateReserved": "2026-06-18T09:26:55.987Z",
"dateUpdated": "2026-08-05T19:05:26.627Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-88804 (GCVE-0-2026-88804)
Vulnerability from cvelistv5 – Published: 2026-09-28 15:58 – Updated: 2026-09-28 18:02
VLAI
EPSS
VEX
Title
Unauthenticated update of public UI settings leading to stored cross-site scripting in Rancher
Summary
An unauthenticated update of public UI settings could be used by remote attackers to execute a stored cross-site scripting attack in the Rancher UI, in SUSE Rancher 2.15 before 2.15.2, 2.14 before 2.14.6, 2.13 before 2.13.10, 2.12 before 2.12.14 and 2.11 before 2.11.18.
Severity
9.6 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-28 16:31 UTC
CWE
- CWE-79 - Improper neutralization of input during web page generation ('cross-site scripting')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/rancher/rancher/security/advis… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| SUSE | Rancher |
Affected:
2.15.0 , < 2.15.2
(semver)
Affected: 2.14.0 , < 2.14.6 (semver) Affected: 2.13.0 , < 2.13.10 (semver) Affected: 2.12.0 , < 2.12.14 (semver) Affected: 2.11.0se , < 2.11.18 (semver) cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:* cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:* cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:* cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:* cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:* |
Date Public
2026-09-28 15:53
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-88804",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-28T16:31:06.472253Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-28T18:02:56.882Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "Rancher",
"product": "Rancher",
"repo": "https://github.com/rancher/rancher/",
"vendor": "SUSE",
"versions": [
{
"lessThan": "2.15.2",
"status": "affected",
"version": "2.15.0",
"versionType": "semver"
},
{
"lessThan": "2.14.6",
"status": "affected",
"version": "2.14.0",
"versionType": "semver"
},
{
"lessThan": "2.13.10",
"status": "affected",
"version": "2.13.0",
"versionType": "semver"
},
{
"lessThan": "2.12.14",
"status": "affected",
"version": "2.12.0",
"versionType": "semver"
},
{
"lessThan": "2.11.18",
"status": "affected",
"version": "2.11.0se",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.15.2",
"versionStartIncluding": "2.15.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.14.6",
"versionStartIncluding": "2.14.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.13.10",
"versionStartIncluding": "2.13.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.12.14",
"versionStartIncluding": "2.12.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.11.18",
"versionStartIncluding": "2.11.0se",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "stopvvar@proton.me"
}
],
"datePublic": "2026-09-28T15:53:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An unauthenticated update of public UI settings could be used by remote attackers to execute a stored cross-site scripting attack in the Rancher UI, in SUSE Rancher 2.15 before 2.15.2, 2.14 before 2.14.6, 2.13 before 2.13.10, 2.12 before 2.12.14 and 2.11 before 2.11.18."
}
],
"value": "An unauthenticated update of public UI settings could be used by remote attackers to execute a stored cross-site scripting attack in the Rancher UI, in SUSE Rancher 2.15 before 2.15.2, 2.14 before 2.14.6, 2.13 before 2.13.10, 2.12 before 2.12.14 and 2.11 before 2.11.18."
}
],
"impacts": [
{
"capecId": "CAPEC-104",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-104 Cross Zone Scripting"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-28T15:58:34.657Z",
"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
"shortName": "suse"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://github.com/rancher/rancher/security/advisories/GHSA-992f-xh8r-jg2f"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Unauthenticated update of public UI settings leading to stored cross-site scripting in Rancher",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
"assignerShortName": "suse",
"cveId": "CVE-2026-88804",
"datePublished": "2026-09-28T15:58:34.657Z",
"dateReserved": "2026-09-10T08:35:07.010Z",
"dateUpdated": "2026-09-28T18:02:56.882Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-88805 (GCVE-0-2026-88805)
Vulnerability from cvelistv5 – Published: 2026-09-28 15:50 – Updated: 2026-09-29 03:55
VLAI
EPSS
VEX
Title
Session Not Revoked Server-Side on Logout in Rancher
Summary
Incorrect credential cleaning on logout could be used by remote attackers to keep access credentials even after the account was logged out. Affected is SUSE Rancher 2.15 before 2.15.2.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-28 00:00 UTC
CWE
- CWE-613 - Insufficient session expiration
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/rancher/rancher/security/advis… | vendor-advisory |
Impacted products
Date Public
2026-09-28 15:40
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-88805",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-28T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T03:55:25.070Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "Rancher",
"product": "Rancher",
"repo": "https://github.com/rancher/rancher/",
"vendor": "SUSE",
"versions": [
{
"lessThan": "2.15.2",
"status": "affected",
"version": "2.15.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.15.2",
"versionStartIncluding": "2.15.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "info@cyberobserve.com"
}
],
"datePublic": "2026-09-28T15:40:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Incorrect credential cleaning on logout could be used by remote attackers to keep access credentials even after the account was logged out. Affected is SUSE Rancher 2.15 before 2.15.2."
}
],
"value": "Incorrect credential cleaning on logout could be used by remote attackers to keep access credentials even after the account was logged out. Affected is SUSE Rancher 2.15 before 2.15.2."
}
],
"impacts": [
{
"capecId": "CAPEC-21",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-21 Exploitation of Trusted Identifiers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-613",
"description": "CWE-613 Insufficient session expiration",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-28T15:50:34.591Z",
"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
"shortName": "suse"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://github.com/rancher/rancher/security/advisories/GHSA-6vpq-mf48-9794"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Session Not Revoked Server-Side on Logout in Rancher",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
"assignerShortName": "suse",
"cveId": "CVE-2026-88805",
"datePublished": "2026-09-28T15:50:34.591Z",
"dateReserved": "2026-09-10T08:35:07.010Z",
"dateUpdated": "2026-09-29T03:55:25.070Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-88808 (GCVE-0-2026-88808)
Vulnerability from cvelistv5 – Published: 2026-09-28 15:36 – Updated: 2026-09-29 03:55
VLAI
EPSS
VEX
Title
Fleet agent copies downstream resources with cluster-admin privileges, allowing cross-namespace writes on downstream clusters
Summary
A vulnerability has been identified within Rancher Manager where the Fleet agent wrote resources to downstream clusters using its own cluster-admin credentials instead of the ServiceAccount pinned to the deployment. It affects multi-tenancy environments where different tenants share the same downstream clusters, for example different privileged or untrusted teams inside the same organization. This could lead to overwritten configuration files.
This issue affected SUSE Rancher Fleet 0.16 before 0.16.2, 0.15 before 0.15.7, and 0.14 before 0.14.11.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-28 00:00 UTC
CWE
- CWE-250 - Execution with unnecessary privileges
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/rancher/fleet/security/advisor… | vendor-advisory |
Impacted products
Date Public
2026-09-28 15:21
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-88808",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-28T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T03:55:24.347Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "Fleet",
"product": "Rancher",
"repo": "https://github.com/rancher/fleet/",
"vendor": "SUSE",
"versions": [
{
"lessThan": "0.16.2",
"status": "affected",
"version": "0.16.0",
"versionType": "semver"
},
{
"lessThan": "0.15.7",
"status": "affected",
"version": "0.15.0",
"versionType": "semver"
},
{
"lessThan": "0.14.11",
"status": "affected",
"version": "0.14.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.16.2",
"versionStartIncluding": "0.16.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.15.7",
"versionStartIncluding": "0.15.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.14.11",
"versionStartIncluding": "0.14.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "g.mygenie@gmail.com"
}
],
"datePublic": "2026-09-28T15:21:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eA vulnerability has been identified within Rancher Manager where the Fleet agent wrote resources to downstream clusters using its own cluster-admin credentials instead of the ServiceAccount pinned to the deployment. It affects multi-tenancy environments where different tenants share the same downstream clusters, for example different privileged or untrusted teams inside the same organization. This could lead to overwritten configuration files.\u003c/div\u003e\u003cdiv\u003eThis issue affected SUSE Rancher Fleet 0.16 before 0.16.2, 0.15 before 0.15.7, and 0.14 before 0.14.11.\u003c/div\u003e"
}
],
"value": "A vulnerability has been identified within Rancher Manager where the Fleet agent wrote resources to downstream clusters using its own cluster-admin credentials instead of the ServiceAccount pinned to the deployment. It affects multi-tenancy environments where different tenants share the same downstream clusters, for example different privileged or untrusted teams inside the same organization. This could lead to overwritten configuration files.\n\nThis issue affected SUSE Rancher Fleet 0.16 before 0.16.2, 0.15 before 0.15.7, and 0.14 before 0.14.11."
}
],
"impacts": [
{
"capecId": "CAPEC-180",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-250",
"description": "CWE-250 Execution with unnecessary privileges",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-28T15:36:13.506Z",
"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
"shortName": "suse"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://github.com/rancher/fleet/security/advisories/GHSA-q9v4-358v-r8q5"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Fleet agent copies downstream resources with cluster-admin privileges, allowing cross-namespace writes on downstream clusters",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
"assignerShortName": "suse",
"cveId": "CVE-2026-88808",
"datePublished": "2026-09-28T15:36:13.506Z",
"dateReserved": "2026-09-10T08:35:07.010Z",
"dateUpdated": "2026-09-29T03:55:24.347Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93540 (GCVE-0-2026-93540)
Vulnerability from cvelistv5 – Published: 2026-09-28 14:45 – Updated: 2026-09-28 16:22
VLAI
EPSS
VEX
Title
Fleet applies namespace labels and annotations without the bundle's service account privileges
Summary
A privilege mismatch was found in Fleet. When a bundle requested namespace labels or annotations through the namespaceLabels and namespaceAnnotations options, the resulting namespace metadata update was not subject to the same authorization as the rest of the bundle's deployment. As a result, a bundle could change labels and annotations on a target namespace even when the identity it was pinned to was not authorized to modify that namespace.
This affected SUSE Rancher Fleet 0.16 before 0.16.2, 0.15 before 0.15.7, 0.14 before 0.14.11, 0.13 before 0.13.16 and potentially older versions.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-28 15:25 UTC
CWE
- CWE-266 - Incorrect privilege assignment
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/rancher/fleet/security/advisor… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| SUSE | Rancher |
Affected:
0.16.0 , < 0.16.1
(semver)
Affected: 0.15.0 , < 0.15.7 (semver) Affected: 0.14.0 , < 0.14.11 (semver) Affected: 0.13.0 , < 0.13.16 (semver) cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:* cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:* cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:* cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:* |
Date Public
2026-09-28 14:28
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-93540",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-28T15:25:53.294940Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-28T16:22:25.780Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "Fleet",
"product": "Rancher",
"repo": "https://github.com/rancher/fleet/",
"vendor": "SUSE",
"versions": [
{
"lessThan": "0.16.1",
"status": "affected",
"version": "0.16.0",
"versionType": "semver"
},
{
"lessThan": "0.15.7",
"status": "affected",
"version": "0.15.0",
"versionType": "semver"
},
{
"lessThan": "0.14.11",
"status": "affected",
"version": "0.14.0",
"versionType": "semver"
},
{
"lessThan": "0.13.16",
"status": "affected",
"version": "0.13.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.16.1",
"versionStartIncluding": "0.16.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.15.7",
"versionStartIncluding": "0.15.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.14.11",
"versionStartIncluding": "0.14.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.13.16",
"versionStartIncluding": "0.13.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "g.mygenie@gmail.com"
}
],
"datePublic": "2026-09-28T14:28:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eA privilege mismatch was found in Fleet. When a bundle requested namespace labels or annotations through the \u003ccode\u003enamespaceLabels\u003c/code\u003e and \u003ccode\u003enamespaceAnnotations\u003c/code\u003e options, the resulting namespace metadata update was not subject to the same authorization as the rest of the bundle\u0027s deployment. As a result, a bundle could change labels and annotations on a target namespace even when the identity it was pinned to was not authorized to modify that namespace.\u003c/div\u003e\u003cdiv\u003eThis affected SUSE Rancher Fleet 0.16 before 0.16.2, 0.15 before 0.15.7, 0.14 before 0.14.11, 0.13 before 0.13.16 and potentially older versions.\u003c/div\u003e"
}
],
"value": "A privilege mismatch was found in Fleet. When a bundle requested namespace labels or annotations through the namespaceLabels and namespaceAnnotations options, the resulting namespace metadata update was not subject to the same authorization as the rest of the bundle\u0027s deployment. As a result, a bundle could change labels and annotations on a target namespace even when the identity it was pinned to was not authorized to modify that namespace.\n\nThis affected SUSE Rancher Fleet 0.16 before 0.16.2, 0.15 before 0.15.7, 0.14 before 0.14.11, 0.13 before 0.13.16 and potentially older versions."
}
],
"impacts": [
{
"capecId": "CAPEC-690",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-690 Metadata Spoofing"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "CWE-266 Incorrect privilege assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-28T14:45:42.336Z",
"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
"shortName": "suse"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://github.com/rancher/fleet/security/advisories/GHSA-m93g-8438-2cgg"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Fleet applies namespace labels and annotations without the bundle\u0027s service account privileges",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
"assignerShortName": "suse",
"cveId": "CVE-2026-93540",
"datePublished": "2026-09-28T14:45:42.336Z",
"dateReserved": "2026-09-18T09:08:10.294Z",
"dateUpdated": "2026-09-28T16:22:25.780Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93539 (GCVE-0-2026-93539)
Vulnerability from cvelistv5 – Published: 2026-09-28 14:19 – Updated: 2026-09-28 16:22
VLAI
EPSS
VEX
Title
Unauthenticated GitRepo Spec Mutation via Fleet Git Webhook Receiver
Summary
A vulnerability was discovered in Fleet's Git webhook receiver (the gitjob webhook service). When a webhook secret is not configured, incoming webhook requests are accepted without verification, and processing a request can change the spec.pollingInterval field of a matching GitRepo resource in any namespace. A caller with network access to the webhook service and no Kubernetes credentials can therefore alter GitRepo configuration outside
the namespaces they are authorized for. This only affects SUSE Rancher Fleet 0.16 before 0.16.2, older versions are not affected.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-28 14:59 UTC
CWE
- CWE-306 - Missing authentication for critical function
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/rancher/fleet/security/advisor… | vendor-advisory |
Impacted products
Date Public
2026-09-28 14:16
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-93539",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-28T14:59:38.674475Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-28T16:22:26.433Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "Fleet",
"product": "Rancher",
"repo": "https://github.com/rancher/fleet/",
"vendor": "SUSE",
"versions": [
{
"lessThan": "0.16.2",
"status": "affected",
"version": "0.16.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.16.2",
"versionStartIncluding": "0.16.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "https://github.com/Pig-Tail"
}
],
"datePublic": "2026-09-28T14:16:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A vulnerability was discovered in Fleet\u0027s Git webhook receiver (the \u003ccode\u003egitjob\u003c/code\u003e webhook service). When a webhook secret is not configured, incoming webhook requests are accepted without verification, and processing a request can change the \u003ccode\u003espec.pollingInterval\u003c/code\u003e field of a matching \u003ccode\u003eGitRepo\u003c/code\u003e resource in any namespace. A caller with network access to the webhook service and no Kubernetes credentials can therefore alter \u003ccode\u003eGitRepo\u003c/code\u003e configuration outside\u003cbr\u003e\nthe namespaces they are authorized for.\u0026nbsp; This only affects SUSE Rancher Fleet 0.16 before 0.16.2, older versions are not affected."
}
],
"value": "A vulnerability was discovered in Fleet\u0027s Git webhook receiver (the gitjob webhook service). When a webhook secret is not configured, incoming webhook requests are accepted without verification, and processing a request can change the spec.pollingInterval field of a matching GitRepo resource in any namespace. A caller with network access to the webhook service and no Kubernetes credentials can therefore alter GitRepo configuration outside\n\nthe namespaces they are authorized for.\u00a0 This only affects SUSE Rancher Fleet 0.16 before 0.16.2, older versions are not affected."
}
],
"impacts": [
{
"capecId": "CAPEC-176",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-176 Configuration/Environment Manipulation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing authentication for critical function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-28T14:19:55.071Z",
"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
"shortName": "suse"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://github.com/rancher/fleet/security/advisories/GHSA-8vfv-33cg-g75q"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Unauthenticated GitRepo Spec Mutation via Fleet Git Webhook Receiver",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
"assignerShortName": "suse",
"cveId": "CVE-2026-93539",
"datePublished": "2026-09-28T14:19:55.071Z",
"dateReserved": "2026-09-18T09:08:10.294Z",
"dateUpdated": "2026-09-28T16:22:26.433Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93538 (GCVE-0-2026-93538)
Vulnerability from cvelistv5 – Published: 2026-09-28 14:10 – Updated: 2026-09-28 16:22
VLAI
EPSS
VEX
Title
Cross-tenant BundleDeployment and Secret disclosure via spoofed cluster labels during agent-initiated registration in Fleet
Summary
A cross-tenant authorization issue was discovered in SUSE Rancher Fleet. During agent-initiated cluster registration, cluster labels supplied by the registering agent, including labels in the reserved management.cattle.io/ namespace such as the cluster display name label, were applied to the resulting upstream Cluster object. Because Fleet resolves GitRepo and Bundle targets from those cluster labels, a party able to register a cluster into a Fleet workspace namespace shared with other tenants could cause its own cluster to satisfy targeting rules that administrators intended for a different cluster.
This affects SUSE Rancher Fleet 0.16 before 0.16.1, 0.15 before 0.15.6, 0.14 before 0.14.10, 0.13 before 0.13.15, 0.12 before 0.12.19 and older versions.
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-28 15:46 UTC
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/rancher/fleet/security/advisor… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| SUSE | Rancher |
Affected:
0.16.0 , < 0.16.1
(semver)
Affected: 0.15.0 , < 0.15.6 (semver) Affected: 0.14.0 , < 0.14.10 (semver) Affected: 0.13.0 , < 0.13.15 (semver) Affected: 0.12.0 , < 0.12.19 (semver) cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:* cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:* cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:* cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:* cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:* |
Date Public
2026-09-28 14:05
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-93538",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-28T15:46:41.479078Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-28T16:22:26.562Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "Fleet",
"product": "Rancher",
"repo": "https://github.com/rancher/fleet/",
"vendor": "SUSE",
"versions": [
{
"lessThan": "0.16.1",
"status": "affected",
"version": "0.16.0",
"versionType": "semver"
},
{
"lessThan": "0.15.6",
"status": "affected",
"version": "0.15.0",
"versionType": "semver"
},
{
"lessThan": "0.14.10",
"status": "affected",
"version": "0.14.0",
"versionType": "semver"
},
{
"lessThan": "0.13.15",
"status": "affected",
"version": "0.13.0",
"versionType": "semver"
},
{
"lessThan": "0.12.19",
"status": "affected",
"version": "0.12.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.16.1",
"versionStartIncluding": "0.16.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.15.6",
"versionStartIncluding": "0.15.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.14.10",
"versionStartIncluding": "0.14.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.13.15",
"versionStartIncluding": "0.13.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.12.19",
"versionStartIncluding": "0.12.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "https://github.com/Pig-Tail"
}
],
"datePublic": "2026-09-28T14:05:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A cross-tenant authorization issue was discovered in SUSE Rancher Fleet. During agent-initiated\u0026nbsp;cluster registration, cluster labels supplied by the registering agent, including labels in the reserved \u003ccode\u003emanagement.cattle.io/\u003c/code\u003e namespace such as the cluster display name label, were applied to the resulting upstream \u003ccode\u003eCluster\u003c/code\u003e object. Because Fleet resolves \u003ccode\u003eGitRepo\u003c/code\u003e and \u003ccode\u003eBundle\u003c/code\u003e targets from those cluster labels, a party able to register a cluster into a Fleet workspace namespace shared with other tenants could cause its own cluster to satisfy targeting rules that administrators intended for a different cluster.\u003cbr\u003eThis affects SUSE Rancher Fleet 0.16 before 0.16.1, 0.15 before 0.15.6, 0.14 before 0.14.10, 0.13 before 0.13.15, 0.12 before 0.12.19 and older versions."
}
],
"value": "A cross-tenant authorization issue was discovered in SUSE Rancher Fleet. During agent-initiated\u00a0cluster registration, cluster labels supplied by the registering agent, including labels in the reserved management.cattle.io/ namespace such as the cluster display name label, were applied to the resulting upstream Cluster object. Because Fleet resolves GitRepo and Bundle targets from those cluster labels, a party able to register a cluster into a Fleet workspace namespace shared with other tenants could cause its own cluster to satisfy targeting rules that administrators intended for a different cluster.\nThis affects SUSE Rancher Fleet 0.16 before 0.16.1, 0.15 before 0.15.6, 0.14 before 0.14.10, 0.13 before 0.13.15, 0.12 before 0.12.19 and older versions."
}
],
"impacts": [
{
"capecId": "CAPEC-122",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-122 Privilege Abuse"
}
]
},
{
"capecId": "CAPEC-195",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-195 Principal Spoof"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-290",
"description": "CWE-290 Authentication bypass by spoofing",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization bypass through User-Controlled key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-28T14:10:21.720Z",
"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
"shortName": "suse"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://github.com/rancher/fleet/security/advisories/GHSA-h9p5-fp5h-qpqr"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Cross-tenant BundleDeployment and Secret disclosure via spoofed cluster labels during agent-initiated registration in Fleet",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
"assignerShortName": "suse",
"cveId": "CVE-2026-93538",
"datePublished": "2026-09-28T14:10:21.720Z",
"dateReserved": "2026-09-18T09:08:10.294Z",
"dateUpdated": "2026-09-28T16:22:26.562Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93537 (GCVE-0-2026-93537)
Vulnerability from cvelistv5 – Published: 2026-09-28 13:29 – Updated: 2026-09-28 17:54
VLAI
EPSS
VEX
Title
Path traversal in Fleet Helm valuesFiles allows disclosure of files outside the bundle directory
Summary
A user who can supply bundle content to a repository referenced by a GitRepo resource, for example through Git push access, or through permission to create or modify a GitRepo, can cause SUSE Rancher Fleet to read files from the filesystem of the environment that processes the bundle and include their contents in the generated Bundle resource. This can expose configuration or credential material that the user has no Kubernetes RBAC permission to read, including Helm registry credentials made available to the bundle-processing job when per-path Helm credentials are configured.
This affects Fleet 0.16 before 0.16.2, 0.15 before 0.15.7, 0.14 before 0.14.11, 0.13 before 0.13.16, 0.12 before 0.12.20 and potentially older unsupported versions.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-28 17:54 UTC
CWE
- CWE-23 - Relative path traversal
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/rancher/fleet/security/advisor… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| SUSE | Rancher |
Affected:
0.16.0 , < 0.16.2
(semver)
Affected: 0.15.0 , < 0.15.7 (semver) Affected: 0.14.0 , < 0.14.11 (semver) Affected: 0.13.0 , < 0.13.16 (semver) Affected: 0.12.0 , < 0.12.20 (semver) cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:* cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:* cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:* cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:* cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:* |
Date Public
2026-09-28 12:15
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-93537",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-28T17:54:00.943037Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-28T17:54:22.754Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "Fleet",
"product": "Rancher",
"repo": "https://github.com/rancher/fleet/",
"vendor": "SUSE",
"versions": [
{
"lessThan": "0.16.2",
"status": "affected",
"version": "0.16.0",
"versionType": "semver"
},
{
"lessThan": "0.15.7",
"status": "affected",
"version": "0.15.0",
"versionType": "semver"
},
{
"lessThan": "0.14.11",
"status": "affected",
"version": "0.14.0",
"versionType": "semver"
},
{
"lessThan": "0.13.16",
"status": "affected",
"version": "0.13.0",
"versionType": "semver"
},
{
"lessThan": "0.12.20",
"status": "affected",
"version": "0.12.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.16.2",
"versionStartIncluding": "0.16.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.15.7",
"versionStartIncluding": "0.15.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.14.11",
"versionStartIncluding": "0.14.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.13.16",
"versionStartIncluding": "0.13.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.12.20",
"versionStartIncluding": "0.12.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "https://github.com/Pig-Tail"
}
],
"datePublic": "2026-09-28T12:15:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A user who can supply bundle content to a repository referenced by a \u003ccode\u003eGitRepo\u003c/code\u003e resource, for example through Git push access, or through permission to create or modify a \u003ccode\u003eGitRepo\u003c/code\u003e, can cause SUSE Rancher Fleet to read files from the filesystem of the environment that processes the bundle and include their contents in the generated \u003ccode\u003eBundle\u003c/code\u003e resource. This can expose configuration or credential material that the user has no Kubernetes RBAC permission to read, including Helm registry credentials made available to the bundle-processing job when per-path Helm credentials are configured.\u003cbr\u003eThis affects Fleet 0.16 before 0.16.2, 0.15 before 0.15.7, 0.14 before 0.14.11, 0.13 before 0.13.16, 0.12 before 0.12.20 and potentially older unsupported versions."
}
],
"value": "A user who can supply bundle content to a repository referenced by a GitRepo resource, for example through Git push access, or through permission to create or modify a GitRepo, can cause SUSE Rancher Fleet to read files from the filesystem of the environment that processes the bundle and include their contents in the generated Bundle resource. This can expose configuration or credential material that the user has no Kubernetes RBAC permission to read, including Helm registry credentials made available to the bundle-processing job when per-path Helm credentials are configured.\nThis affects Fleet 0.16 before 0.16.2, 0.15 before 0.15.7, 0.14 before 0.14.11, 0.13 before 0.13.16, 0.12 before 0.12.20 and potentially older unsupported versions."
}
],
"impacts": [
{
"capecId": "CAPEC-122",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-122 Privilege Abuse"
}
]
},
{
"capecId": "CAPEC-180",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-180"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-23",
"description": "CWE-23 Relative path traversal",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-28T13:29:10.263Z",
"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
"shortName": "suse"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://github.com/rancher/fleet/security/advisories/GHSA-wpfm-r97v-3j4h"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Path traversal in Fleet Helm valuesFiles allows disclosure of files outside the bundle directory",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
"assignerShortName": "suse",
"cveId": "CVE-2026-93537",
"datePublished": "2026-09-28T13:29:10.263Z",
"dateReserved": "2026-09-18T09:08:10.294Z",
"dateUpdated": "2026-09-28T17:54:22.754Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-75035 (GCVE-0-2026-75035)
Vulnerability from cvelistv5 – Published: 2026-09-03 15:07 – Updated: 2026-09-05 01:25
VLAI
EPSS
VEX
Title
Rancher: ext.cattle.io/v1 Token store: cross-user token disclosure via label-selector scoping bypass
Summary
A flaw was found in Rancher Manager. When a non-administrative caller supplied a label selector naming a different user, the ext.cattle.io/v1 Token store dropped its internal owner filter instead of returning an empty result. Any authenticated user could therefore list and watch every other user's tokens, disclosing token metadata and the stored salted hash of the bearer token.
This issue affects Rancher: before 2.15.1.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-05 01:25 UTC
CWE
- CWE-639 - Authorization bypass through User-Controlled key
Assigner
References
1 reference
Date Public
2026-08-31 15:01
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-75035",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-05T01:25:28.809972Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-05T01:25:40.696Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Rancher",
"repo": "https://github.com/rancher/rancher",
"vendor": "SUSE",
"versions": [
{
"lessThan": "2.15.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"datePublic": "2026-08-31T15:01:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA flaw was found in Rancher Manager. When a non-administrative caller supplied a label selector naming a different user, the ext.cattle.io/v1 Token store dropped its internal owner filter instead of returning an empty result. Any authenticated user could therefore list and watch every other user\u0027s tokens, disclosing token metadata and the stored salted hash of the bearer token.\u003c/p\u003e\u003cp\u003eThis issue affects Rancher: before 2.15.1.\u003c/p\u003e"
}
],
"value": "A flaw was found in Rancher Manager. When a non-administrative caller supplied a label selector naming a different user, the ext.cattle.io/v1 Token store dropped its internal owner filter instead of returning an empty result. Any authenticated user could therefore list and watch every other user\u0027s tokens, disclosing token metadata and the stored salted hash of the bearer token.\n\n\n\nThis issue affects Rancher: before 2.15.1."
}
],
"impacts": [
{
"capecId": "CAPEC-77",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-77 Manipulating User-Controlled Variables"
}
]
},
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
},
{
"capecId": "CAPEC-116",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-116 Excavation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization bypass through User-Controlled key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T15:07:11.685Z",
"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
"shortName": "suse"
},
"references": [
{
"url": "https://github.com/rancher/rancher/releases/tag/v2.15.1"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Rancher: ext.cattle.io/v1 Token store: cross-user token disclosure via label-selector scoping bypass",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
"assignerShortName": "suse",
"cveId": "CVE-2026-75035",
"datePublished": "2026-09-03T15:07:11.685Z",
"dateReserved": "2026-08-17T15:22:54.444Z",
"dateUpdated": "2026-09-05T01:25:40.696Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-75034 (GCVE-0-2026-75034)
Vulnerability from cvelistv5 – Published: 2026-09-03 15:01 – Updated: 2026-09-04 03:56
VLAI
EPSS
VEX
Title
Rancher: SAML Assertion Replay
Summary
A flaw was found in Rancher Manager. The SAML assertion replay protection introduced by the fix for CVE-2026-44946 recorded consumed assertion IDs in a per-process cache, so each replica only detected replays that reached the same pod. In a high-availability deployment, an attacker holding a captured assertion could replay it once against every other replica to obtain additional authenticated sessions as the victim.
This issue affects Rancher: before 2.15.1.
Severity
7.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-03 00:00 UTC
CWE
- CWE-294 - Authentication bypass by capture-replay
Assigner
References
1 reference
Date Public
2026-08-31 14:58
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-75034",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-03T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T03:56:03.896Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Rancher",
"repo": "https://github.com/rancher/rancher",
"vendor": "SUSE",
"versions": [
{
"lessThan": "2.15.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wade Sparks"
}
],
"datePublic": "2026-08-31T14:58:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A flaw was found in Rancher Manager. The SAML assertion replay protection introduced by the fix for CVE-2026-44946 recorded consumed assertion IDs in a per-process cache, so each replica only detected replays that reached the same pod. In a high-availability deployment, an attacker holding a captured assertion could replay it once against every other replica to obtain additional authenticated sessions as the victim.\u003cbr\u003e\u003cp\u003eThis issue affects Rancher: before 2.15.1.\u003c/p\u003e"
}
],
"value": "A flaw was found in Rancher Manager. The SAML assertion replay protection introduced by the fix for CVE-2026-44946 recorded consumed assertion IDs in a per-process cache, so each replica only detected replays that reached the same pod. In a high-availability deployment, an attacker holding a captured assertion could replay it once against every other replica to obtain additional authenticated sessions as the victim.\n\n\nThis issue affects Rancher: before 2.15.1."
}
],
"impacts": [
{
"capecId": "CAPEC-60",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-60 Reusing Session IDs (aka Session Replay)"
}
]
},
{
"capecId": "CAPEC-94",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-94 Adversary in the Middle (AiTM)"
}
]
},
{
"capecId": "CAPEC-593",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-593 Session Hijacking"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-294",
"description": "CWE-294 Authentication bypass by capture-replay",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T15:01:16.635Z",
"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
"shortName": "suse"
},
"references": [
{
"url": "https://github.com/rancher/rancher/releases/tag/v2.15.1"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Rancher: SAML Assertion Replay",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
"assignerShortName": "suse",
"cveId": "CVE-2026-75034",
"datePublished": "2026-09-03T15:01:16.635Z",
"dateReserved": "2026-08-17T15:22:54.444Z",
"dateUpdated": "2026-09-04T03:56:03.896Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-75033 (GCVE-0-2026-75033)
Vulnerability from cvelistv5 – Published: 2026-09-03 14:57 – Updated: 2026-09-03 15:13
VLAI
EPSS
VEX
Title
Rancher: Cross-Cluster Secret Leakage via Namespace projectId Annotation Spoofing
Summary
A flaw was found in Rancher Manager. Project Secrets were propagated into a namespace based only on its `field.cattle.io/projectId` annotation, without verifying that the referenced project belonged to the same downstream cluster. A user able to create namespaces on one cluster could set the annotation to a project ID from another cluster and have that project's secrets copied into a namespace under their control.
This issue affects Rancher: before 2.15.1.
Severity
7.7 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-03 15:13 UTC
CWE
- CWE-639 - Authorization bypass through User-Controlled key
Assigner
References
1 reference
Date Public
2026-08-31 14:52
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-75033",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-03T15:13:38.725376Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T15:13:54.624Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Rancher",
"repo": "https://github.com/rancher/rancher",
"vendor": "SUSE",
"versions": [
{
"lessThan": "2.15.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Alex Seymour"
}
],
"datePublic": "2026-08-31T14:52:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A flaw was found in Rancher Manager. Project Secrets were propagated into a namespace based only on its `field.cattle.io/projectId` annotation, without verifying that the referenced project belonged to the same downstream cluster. A user able to create namespaces on one cluster could set the annotation to a project ID from another cluster and have that project\u0027s secrets copied into a namespace under their control.\u003cbr\u003e\u003cp\u003eThis issue affects Rancher: before 2.15.1.\u003c/p\u003e"
}
],
"value": "A flaw was found in Rancher Manager. Project Secrets were propagated into a namespace based only on its `field.cattle.io/projectId` annotation, without verifying that the referenced project belonged to the same downstream cluster. A user able to create namespaces on one cluster could set the annotation to a project ID from another cluster and have that project\u0027s secrets copied into a namespace under their control.\n\n\nThis issue affects Rancher: before 2.15.1."
}
],
"impacts": [
{
"capecId": "CAPEC-21",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-21 Exploitation of Trusted Identifiers"
}
]
},
{
"capecId": "CAPEC-116",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-116 Excavation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization bypass through User-Controlled key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T14:57:34.334Z",
"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
"shortName": "suse"
},
"references": [
{
"url": "https://github.com/rancher/rancher/releases/tag/v2.15.1"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Rancher: Cross-Cluster Secret Leakage via Namespace projectId Annotation Spoofing",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
"assignerShortName": "suse",
"cveId": "CVE-2026-75033",
"datePublished": "2026-09-03T14:57:34.334Z",
"dateReserved": "2026-08-17T15:22:54.443Z",
"dateUpdated": "2026-09-03T15:13:54.624Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-71404 (GCVE-0-2026-71404)
Vulnerability from cvelistv5 – Published: 2026-09-03 14:51 – Updated: 2026-09-03 15:07
VLAI
EPSS
VEX
Title
Rancher: Ownership-less ClusterRole overwrite via attacker-controlled cr-name annotation on GlobalRole
Summary
A flaw was found in Rancher Manager. The GlobalRole controller derived the target ClusterRole name from the user-settable `authz.management.cattle.io/cr-name` annotation and overwrote that object's rules without verifying ownership. A user with delegated GlobalRole create or update permission could point the annotation at any existing ClusterRole, such as `cluster-admin`, and revoke the permissions of every principal bound to it. The change persists after the malicious GlobalRole is deleted.
This issue affects Rancher: before 2.15.1.
Severity
8.7 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-03 15:06 UTC
CWE
- CWE-639 - Authorization bypass through User-Controlled key
Assigner
References
2 references
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-71404",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-03T15:06:03.098792Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T15:07:12.467Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Rancher",
"repo": "https://github.com/rancher/rancher",
"vendor": "SUSE",
"versions": [
{
"lessThan": "2.15.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "https://github.com/Pig-Tail"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A flaw was found in Rancher Manager. The GlobalRole controller derived the target ClusterRole name from the user-settable `authz.management.cattle.io/cr-name` annotation and overwrote that object\u0027s rules without verifying ownership. A user with delegated GlobalRole create or update permission could point the annotation at any existing ClusterRole, such as `cluster-admin`, and revoke the permissions of every principal bound to it. The change persists after the malicious GlobalRole is deleted.\u003cbr\u003e\u003cp\u003eThis issue affects Rancher: before 2.15.1.\u003c/p\u003e"
}
],
"value": "A flaw was found in Rancher Manager. The GlobalRole controller derived the target ClusterRole name from the user-settable `authz.management.cattle.io/cr-name` annotation and overwrote that object\u0027s rules without verifying ownership. A user with delegated GlobalRole create or update permission could point the annotation at any existing ClusterRole, such as `cluster-admin`, and revoke the permissions of every principal bound to it. The change persists after the malicious GlobalRole is deleted.\n\n\nThis issue affects Rancher: before 2.15.1."
}
],
"impacts": [
{
"capecId": "CAPEC-176",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-176 Configuration/Environment Manipulation"
}
]
},
{
"capecId": "CAPEC-77",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-77 Manipulating User-Controlled Variables"
}
]
},
{
"capecId": "CAPEC-240",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-240 Resource Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization bypass through User-Controlled key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T14:51:44.678Z",
"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
"shortName": "suse"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/rancher/rancher/pull/56642"
},
{
"tags": [
"patch"
],
"url": "https://github.com/rancher/rancher/pull/56593"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Rancher: Ownership-less ClusterRole overwrite via attacker-controlled cr-name annotation on GlobalRole",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
"assignerShortName": "suse",
"cveId": "CVE-2026-71404",
"datePublished": "2026-09-03T14:51:44.678Z",
"dateReserved": "2026-08-06T11:38:54.896Z",
"dateUpdated": "2026-09-03T15:07:12.467Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-71403 (GCVE-0-2026-71403)
Vulnerability from cvelistv5 – Published: 2026-09-03 14:45 – Updated: 2026-09-04 03:55
VLAI
EPSS
VEX
Title
Rancher: Identity-field mutation in /v3/users allows account hijack via principal rebind
Summary
A flaw was found in Rancher Manager. The /v3/users update path did not enforce immutability of a User resource's `username` and `principalIds` fields. A user holding the `update` verb on `users.management.cattle.io` could inject a foreign identity provider principal into any account, so that the next login by the owner of that principal was bound to the victim's account and inherited its role bindings.
This issue affects Rancher: before 2.15.1.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-03 00:00 UTC
CWE
- CWE-639 - Authorization bypass through User-Controlled key
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/rancher/rancher/pull/56616 | patch |
Date Public
2026-08-31 14:37
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-71403",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-03T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T03:55:59.443Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"Manager"
],
"product": "Rancher",
"repo": "https://github.com/rancher/rancher",
"vendor": "SUSE",
"versions": [
{
"lessThan": "2.15.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Andrej Tom\u010di"
}
],
"datePublic": "2026-08-31T14:37:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A flaw was found in Rancher Manager. The /v3/users update path did not enforce immutability of a User resource\u0027s `username` and `principalIds` fields. A user holding the `update` verb on `users.management.cattle.io` could inject a foreign identity provider principal into any account, so that the next login by the owner of that principal was bound to the victim\u0027s account and inherited its role bindings.\u003cbr\u003e\u003cp\u003eThis issue affects Rancher: before 2.15.1.\u003c/p\u003e"
}
],
"value": "A flaw was found in Rancher Manager. The /v3/users update path did not enforce immutability of a User resource\u0027s `username` and `principalIds` fields. A user holding the `update` verb on `users.management.cattle.io` could inject a foreign identity provider principal into any account, so that the next login by the owner of that principal was bound to the victim\u0027s account and inherited its role bindings.\n\n\nThis issue affects Rancher: before 2.15.1."
}
],
"impacts": [
{
"capecId": "CAPEC-21",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-21 Exploitation of Trusted Identifiers"
}
]
},
{
"capecId": "CAPEC-151",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-151 Identity Spoofing"
}
]
},
{
"capecId": "CAPEC-593",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-593 Session Hijacking"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization bypass through User-Controlled key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T14:45:37.468Z",
"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
"shortName": "suse"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/rancher/rancher/pull/56616"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Rancher: Identity-field mutation in /v3/users allows account hijack via principal rebind",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
"assignerShortName": "suse",
"cveId": "CVE-2026-71403",
"datePublished": "2026-09-03T14:45:37.468Z",
"dateReserved": "2026-08-06T11:38:54.896Z",
"dateUpdated": "2026-09-04T03:55:59.443Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-44945 (GCVE-0-2026-44945)
Vulnerability from cvelistv5 – Published: 2026-08-05 10:00 – Updated: 2026-08-06 03:55
VLAI
EPSS
VEX
Title
Cross-Cluster Impersonation Confused-Deputy Privilege Escalation
Summary
A privilege escalation vulnerability exists in Rancher's impersonation middleware (pkg/auth/requests/impersonate.go). An authenticated Rancher user with the default user
global role can gain full administrative access to the Rancher control
plane and transitively to all downstream clusters it manages.
This issue affects Rancher: from 2.11.0 before 2.11.16, from 2.12.0 before 2.12.12, from 2.13.0 before 2.13.8, and from 2.14.0 before 2.14.2.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-05 00:00 UTC
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/rancher/rancher/pull/55983 | patch |
| https://github.com/rancher/rancher/security/advis… | vendor-advisory |
| https://bugzilla.suse.com/show_bug.cgi?id=CVE-202… | issue-tracking |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-44945",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-05T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T03:55:24.710Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "Rancher",
"product": "Rancher",
"repo": "https://github.com/rancher/rancher",
"vendor": "SUSE",
"versions": [
{
"changes": [
{
"at": "2.11.16",
"status": "unaffected"
}
],
"lessThan": "2.11.16",
"status": "affected",
"version": "2.11.0",
"versionType": "semver"
},
{
"changes": [
{
"at": "2.12.12",
"status": "unaffected"
}
],
"lessThan": "2.12.12",
"status": "affected",
"version": "2.12.0",
"versionType": "semver"
},
{
"changes": [
{
"at": "2.13.8",
"status": "unaffected"
}
],
"lessThan": "2.13.8",
"status": "affected",
"version": "2.13.0",
"versionType": "semver"
},
{
"changes": [
{
"at": "2.14.4",
"status": "unaffected"
}
],
"lessThan": "2.14.2",
"status": "affected",
"version": "2.14.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This vulnerability was discovered and reported by @BenTheCyberOne."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A privilege escalation vulnerability exists in Rancher\u0027s impersonation middleware (\u003ccode\u003epkg/auth/requests/impersonate.go\u003c/code\u003e). An authenticated Rancher user with the default \u003ccode\u003euser\u003c/code\u003e\n global role can gain full administrative access to the Rancher control \nplane and transitively to all downstream clusters it manages.\u003cp\u003eThis issue affects Rancher: from 2.11.0 before 2.11.16, from 2.12.0 before 2.12.12, from 2.13.0 before 2.13.8, and from 2.14.0 before 2.14.2.\u003c/p\u003e"
}
],
"value": "A privilege escalation vulnerability exists in Rancher\u0027s impersonation middleware (pkg/auth/requests/impersonate.go). An authenticated Rancher user with the default user\n global role can gain full administrative access to the Rancher control \nplane and transitively to all downstream clusters it manages.\n\nThis issue affects Rancher: from 2.11.0 before 2.11.16, from 2.12.0 before 2.12.12, from 2.13.0 before 2.13.8, and from 2.14.0 before 2.14.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-441",
"description": "CWE-441: Unintended Proxy or Intermediary (\u0027Confused Deputy\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-497",
"description": "CWE-497 Exposure of sensitive system information to an unauthorized control sphere",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T10:00:04.286Z",
"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
"shortName": "suse"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/rancher/rancher/pull/55983"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://github.com/rancher/rancher/security/advisories/GHSA-v584-7w32-jwpq"
},
{
"tags": [
"issue-tracking"
],
"url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-44945"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Cross-Cluster Impersonation Confused-Deputy Privilege Escalation",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
"assignerShortName": "suse",
"cveId": "CVE-2026-44945",
"datePublished": "2026-08-05T10:00:04.286Z",
"dateReserved": "2026-05-08T12:29:48.968Z",
"dateUpdated": "2026-08-06T03:55:24.710Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55998 (GCVE-0-2026-55998)
Vulnerability from cvelistv5 – Published: 2026-08-05 07:51 – Updated: 2026-08-05 13:13
VLAI
EPSS
VEX
Title
Cluster Existence Oracle via Unauthenticated Import Endpoint
Summary
The endpoint /v3/import/{token}_{clusterId}.yaml retrieves the cluster object before validating the token. When a valid cluster ID references a cluster that has private registry secrets configured, a nil pointer dereference in pkg/systemtemplate/private_registry.go causes the request to return HTTP 502 Bad Gateway. For cluster IDs that do not exist, the endpoint returns HTTP 200. This observable difference in response codes constitutes a reliable enumeration oracle.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-05 13:11 UTC
CWE
- CWE-204 - Observable response discrepancy
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55998",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-05T13:11:15.281747Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T13:13:02.031Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "Rancher",
"product": "Rancher",
"vendor": "SUSE",
"versions": [
{
"lessThan": "2.14.4",
"status": "affected",
"version": "2.14.0",
"versionType": "semver"
},
{
"lessThan": "2.13.8",
"status": "affected",
"version": "2.13.0",
"versionType": "semver"
},
{
"lessThan": "2.12.12",
"status": "affected",
"version": "2.12.0",
"versionType": "semver"
},
{
"lessThan": "2.11.16",
"status": "affected",
"version": "2.11.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This vulnerability was discovered and reported by Michael Wollner (@ibonok) from Deutsche Telekom AG."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cspan\u003eThe endpoint /v3/import/{token}_{clusterId}.yaml retrieves the cluster object before validating the token. When a valid cluster ID references a cluster that has private registry secrets configured, a nil pointer dereference in pkg/systemtemplate/private_registry.go causes the request to return HTTP 502 Bad Gateway. For cluster IDs that do not exist, the endpoint returns HTTP 200. This observable difference in response codes constitutes a reliable enumeration oracle.\u003c/span\u003e\u003c/p\u003e"
}
],
"value": "The endpoint /v3/import/{token}_{clusterId}.yaml retrieves the cluster object before validating the token. When a valid cluster ID references a cluster that has private registry secrets configured, a nil pointer dereference in pkg/systemtemplate/private_registry.go causes the request to return HTTP 502 Bad Gateway. For cluster IDs that do not exist, the endpoint returns HTTP 200. This observable difference in response codes constitutes a reliable enumeration oracle."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-204",
"description": "CWE-204 Observable response discrepancy",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T07:51:21.731Z",
"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
"shortName": "suse"
},
"references": [
{
"url": "https://github.com/rancher/rancher/security/advisories/GHSA-23h9-rr79-r3gh"
},
{
"url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-55998"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Cluster Existence Oracle via Unauthenticated Import Endpoint",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
"assignerShortName": "suse",
"cveId": "CVE-2026-55998",
"datePublished": "2026-08-05T07:51:21.731Z",
"dateReserved": "2026-06-18T09:26:55.988Z",
"dateUpdated": "2026-08-05T13:13:02.031Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}