Vulnerability-Lookup

CVE-2026-44938 (GCVE-0-2026-44938)

Vulnerability from cvelistv5 – Published: 2026-07-07 13:05 – Updated: 2026-07-08 03:56

Title

Fleet has PSS Bypass through addLabelsFromOptions in Fleet Agent

Summary

A vulnerability has been identified in Fleet's agent-side deployer, which did not filter security-sensitive keys from namespaceLabels in fleet.yaml (or BundleDeployment.spec.options.namespaceLabels) when applying them to the target namespace. An attacker with git push access to a Fleet-monitored repository could overwrite Pod Security Standards (PSS) enforcement labels on a target namespace. This allows the attacker to weaken admission controls and deploy workloads that PSS policies would otherwise block.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-07 00:00 UTC

CWE

CWE-522 - Insufficiently Protected Credentials

Assigner

suse CNA under the mitre root

CNA scorecard B 80/100 over 118 records in the last 180 days details

References

2 references

URL	Tags
https://bugzilla.suse.com/show_bug.cgi?id=CVE-202…
https://github.com/advisories/GHSA-864g-863m-vcvq

Impacted products

1 product

Vendor	Product	Version	CPE status
SUSE	Rancher	Affected: 0.15.0 , < 0.15.2 (semver) Affected: 0.14.0 , < 0.14.6 (semver) Affected: 0.13.0 , < 0.13.11 (semver) Affected: 0.12.0 , < 0.12.15 (semver)	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-44938",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-07T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-08T03:56:44.251Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "github.com/rancher/fleet",
          "product": "Rancher",
          "vendor": "SUSE",
          "versions": [
            {
              "lessThan": "0.15.2",
              "status": "affected",
              "version": "0.15.0",
              "versionType": "semver"
            },
            {
              "lessThan": "0.14.6",
              "status": "affected",
              "version": "0.14.0",
              "versionType": "semver"
            },
            {
              "lessThan": "0.13.11",
              "status": "affected",
              "version": "0.13.0",
              "versionType": "semver"
            },
            {
              "lessThan": "0.12.15",
              "status": "affected",
              "version": "0.12.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eA vulnerability has been identified in Fleet\u0027s agent-side deployer, which did not filter security-sensitive keys from \u003ccode\u003enamespaceLabels\u003c/code\u003e in \u003ccode\u003efleet.yaml\u003c/code\u003e (or \u003ccode\u003eBundleDeployment.spec.options.namespaceLabels\u003c/code\u003e) when applying them to the target namespace.\u003c/p\u003e\n\u003cp\u003eAn attacker with \u003ccode\u003egit push\u003c/code\u003e access to a\n Fleet-monitored repository could overwrite Pod Security Standards (PSS)\n enforcement labels on a target namespace. This allows the attacker to \nweaken admission controls and deploy workloads that PSS policies would \notherwise block.\u003c/p\u003e"
            }
          ],
          "value": "A vulnerability has been identified in Fleet\u0027s agent-side deployer, which did not filter security-sensitive keys from namespaceLabels in fleet.yaml (or BundleDeployment.spec.options.namespaceLabels) when applying them to the target namespace.\n\n\n\n\nAn attacker with git push access to a\n Fleet-monitored repository could overwrite Pod Security Standards (PSS)\n enforcement labels on a target namespace. This allows the attacker to \nweaken admission controls and deploy workloads that PSS policies would \notherwise block."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-522",
              "description": "CWE-522: Insufficiently Protected Credentials",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-07T13:05:03.344Z",
        "orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
        "shortName": "suse"
      },
      "references": [
        {
          "url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-44938"
        },
        {
          "url": "https://github.com/advisories/GHSA-864g-863m-vcvq"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Fleet has PSS Bypass through addLabelsFromOptions in Fleet Agent",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
    "assignerShortName": "suse",
    "cveId": "CVE-2026-44938",
    "datePublished": "2026-07-07T13:05:03.344Z",
    "dateReserved": "2026-05-08T12:29:48.967Z",
    "dateUpdated": "2026-07-08T03:56:44.251Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-44938",
      "date": "2026-11-01",
      "epss": "0.00442",
      "percentile": "0.38449"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "packageName": "github.com/rancher/fleet",
                "product": "Rancher",
                "vendor": "SUSE",
                "versions": [
                  {
                    "lessThan": "0.15.2",
                    "status": "affected",
                    "version": "0.15.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "0.14.6",
                    "status": "affected",
                    "version": "0.14.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "0.13.11",
                    "status": "affected",
                    "version": "0.13.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "0.12.15",
                    "status": "affected",
                    "version": "0.12.0",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "meissner@suse.de"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:suse:rancher_fleet:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8DE7373C-74E0-4B59-AF44-ECB9AC0130B9",
                    "versionEndExcluding": "0.12.15",
                    "versionStartIncluding": "0.12.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:suse:rancher_fleet:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D76AA40B-6291-46DC-BE27-BF4B8F6A8B23",
                    "versionEndExcluding": "0.13.11",
                    "versionStartIncluding": "0.13.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:suse:rancher_fleet:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "F267A8DC-9A24-4A98-B765-CEEC0EBC2576",
                    "versionEndExcluding": "0.14.6",
                    "versionStartIncluding": "0.14.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:suse:rancher_fleet:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "BE1A7C49-CBBF-45BA-91F1-D2DA940BE908",
                    "versionEndExcluding": "0.15.2",
                    "versionStartIncluding": "0.15.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "A vulnerability has been identified in Fleet\u0027s agent-side deployer, which did not filter security-sensitive keys from namespaceLabels in fleet.yaml (or BundleDeployment.spec.options.namespaceLabels) when applying them to the target namespace.\n\n\n\n\nAn attacker with git push access to a\n Fleet-monitored repository could overwrite Pod Security Standards (PSS)\n enforcement labels on a target namespace. This allows the attacker to \nweaken admission controls and deploy workloads that PSS policies would \notherwise block."
          },
          {
            "lang": "es",
            "value": "Una vulnerabilidad ha sido identificada en el desplegador del lado del agente de Fleet, que no filtraba claves sensibles a la seguridad de namespaceLabels en fleet.yaml (o BundleDeployment.spec.options.namespaceLabels) al aplicarlas al espacio de nombres objetivo.\n\nUn atacante con acceso de git push a un repositorio monitorizado por Fleet podr\u00eda sobrescribir las etiquetas de aplicaci\u00f3n de los Est\u00e1ndares de Seguridad de Pods (PSS) en un espacio de nombres objetivo. Esto permite al atacante debilitar los controles de admisi\u00f3n y desplegar cargas de trabajo que las pol\u00edticas PSS bloquear\u00edan de otro modo."
          }
        ],
        "id": "CVE-2026-44938",
        "lastModified": "2026-10-25T20:10:00.147",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "meissner@suse.de",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-44938",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-07T00:00:00+00:00",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-07-07T14:16:30.690",
        "references": [
          {
            "source": "meissner@suse.de",
            "tags": [
              "Permissions Required"
            ],
            "url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-44938"
          },
          {
            "source": "meissner@suse.de",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://github.com/advisories/GHSA-864g-863m-vcvq"
          }
        ],
        "sourceIdentifier": "meissner@suse.de",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-522"
              }
            ],
            "source": "meissner@suse.de",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-44938",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-07T14:07:36.547547Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-07T14:07:45.835Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "packageName": "github.com/rancher/fleet",
              "product": "Rancher",
              "vendor": "SUSE",
              "versions": [
                {
                  "lessThan": "0.15.2",
                  "status": "affected",
                  "version": "0.15.0",
                  "versionType": "semver"
                },
                {
                  "lessThan": "0.14.6",
                  "status": "affected",
                  "version": "0.14.0",
                  "versionType": "semver"
                },
                {
                  "lessThan": "0.13.11",
                  "status": "affected",
                  "version": "0.13.0",
                  "versionType": "semver"
                },
                {
                  "lessThan": "0.12.15",
                  "status": "affected",
                  "version": "0.12.0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eA vulnerability has been identified in Fleet\u0027s agent-side deployer, which did not filter security-sensitive keys from \u003ccode\u003enamespaceLabels\u003c/code\u003e in \u003ccode\u003efleet.yaml\u003c/code\u003e (or \u003ccode\u003eBundleDeployment.spec.options.namespaceLabels\u003c/code\u003e) when applying them to the target namespace.\u003c/p\u003e\n\u003cp\u003eAn attacker with \u003ccode\u003egit push\u003c/code\u003e access to a\n Fleet-monitored repository could overwrite Pod Security Standards (PSS)\n enforcement labels on a target namespace. This allows the attacker to \nweaken admission controls and deploy workloads that PSS policies would \notherwise block.\u003c/p\u003e"
                }
              ],
              "value": "A vulnerability has been identified in Fleet\u0027s agent-side deployer, which did not filter security-sensitive keys from namespaceLabels in fleet.yaml (or BundleDeployment.spec.options.namespaceLabels) when applying them to the target namespace.\n\n\n\n\nAn attacker with git push access to a\n Fleet-monitored repository could overwrite Pod Security Standards (PSS)\n enforcement labels on a target namespace. This allows the attacker to \nweaken admission controls and deploy workloads that PSS policies would \notherwise block."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-522",
                  "description": "CWE-522: Insufficiently Protected Credentials",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-07T13:05:03.344Z",
            "orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
            "shortName": "suse"
          },
          "references": [
            {
              "url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-44938"
            },
            {
              "url": "https://github.com/advisories/GHSA-864g-863m-vcvq"
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "title": "Fleet has PSS Bypass through addLabelsFromOptions in Fleet Agent",
          "x_generator": {
            "engine": "Vulnogram 0.1.0-dev"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
        "assignerShortName": "suse",
        "cveId": "CVE-2026-44938",
        "datePublished": "2026-07-07T13:05:03.344Z",
        "dateReserved": "2026-05-08T12:29:48.967Z",
        "dateUpdated": "2026-07-08T03:56:44.251Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-44938

Vulnerability from fkie_nvd - Published: 2026-07-07 14:16 - Updated: 2026-10-25 20:10

Severity

8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	meissner@suse.de	https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-44938	Permissions Required
	meissner@suse.de	https://github.com/advisories/GHSA-864g-863m-vcvq	Vendor Advisory

Impacted products

Vendor	Product	Version
suse	rancher_fleet	*
suse	rancher_fleet	*
suse	rancher_fleet	*
suse	rancher_fleet	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "packageName": "github.com/rancher/fleet",
          "product": "Rancher",
          "vendor": "SUSE",
          "versions": [
            {
              "lessThan": "0.15.2",
              "status": "affected",
              "version": "0.15.0",
              "versionType": "semver"
            },
            {
              "lessThan": "0.14.6",
              "status": "affected",
              "version": "0.14.0",
              "versionType": "semver"
            },
            {
              "lessThan": "0.13.11",
              "status": "affected",
              "version": "0.13.0",
              "versionType": "semver"
            },
            {
              "lessThan": "0.12.15",
              "status": "affected",
              "version": "0.12.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "meissner@suse.de"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:suse:rancher_fleet:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "8DE7373C-74E0-4B59-AF44-ECB9AC0130B9",
              "versionEndExcluding": "0.12.15",
              "versionStartIncluding": "0.12.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:suse:rancher_fleet:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D76AA40B-6291-46DC-BE27-BF4B8F6A8B23",
              "versionEndExcluding": "0.13.11",
              "versionStartIncluding": "0.13.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:suse:rancher_fleet:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F267A8DC-9A24-4A98-B765-CEEC0EBC2576",
              "versionEndExcluding": "0.14.6",
              "versionStartIncluding": "0.14.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:suse:rancher_fleet:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "BE1A7C49-CBBF-45BA-91F1-D2DA940BE908",
              "versionEndExcluding": "0.15.2",
              "versionStartIncluding": "0.15.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability has been identified in Fleet\u0027s agent-side deployer, which did not filter security-sensitive keys from namespaceLabels in fleet.yaml (or BundleDeployment.spec.options.namespaceLabels) when applying them to the target namespace.\n\n\n\n\nAn attacker with git push access to a\n Fleet-monitored repository could overwrite Pod Security Standards (PSS)\n enforcement labels on a target namespace. This allows the attacker to \nweaken admission controls and deploy workloads that PSS policies would \notherwise block."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad ha sido identificada en el desplegador del lado del agente de Fleet, que no filtraba claves sensibles a la seguridad de namespaceLabels en fleet.yaml (o BundleDeployment.spec.options.namespaceLabels) al aplicarlas al espacio de nombres objetivo.\n\nUn atacante con acceso de git push a un repositorio monitorizado por Fleet podr\u00eda sobrescribir las etiquetas de aplicaci\u00f3n de los Est\u00e1ndares de Seguridad de Pods (PSS) en un espacio de nombres objetivo. Esto permite al atacante debilitar los controles de admisi\u00f3n y desplegar cargas de trabajo que las pol\u00edticas PSS bloquear\u00edan de otro modo."
    }
  ],
  "id": "CVE-2026-44938",
  "lastModified": "2026-10-25T20:10:00.147",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "meissner@suse.de",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-44938",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-07-07T00:00:00+00:00",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-07-07T14:16:30.690",
  "references": [
    {
      "source": "meissner@suse.de",
      "tags": [
        "Permissions Required"
      ],
      "url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-44938"
    },
    {
      "source": "meissner@suse.de",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/advisories/GHSA-864g-863m-vcvq"
    }
  ],
  "sourceIdentifier": "meissner@suse.de",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-522"
        }
      ],
      "source": "meissner@suse.de",
      "type": "Secondary"
    }
  ]
}

GHSA-864G-863M-VCVQ

Vulnerability from github – Published: 2026-07-01 20:35 – Updated: 2026-07-01 20:35

Summary

Fleet has PSS Bypass through addLabelsFromOptions in Fleet Agent

Details

Impact

A vulnerability has been identified in Fleet's agent-side deployer, which did not filter security-sensitive keys from namespaceLabels in fleet.yaml (or BundleDeployment.spec.options.namespaceLabels) when applying them to the target namespace.

An attacker with git push access to a Fleet-monitored repository could overwrite Pod Security Standards (PSS) enforcement labels on a target namespace. This allows the attacker to weaken admission controls and deploy workloads that PSS policies would otherwise block.

Important: The final impact on confidentiality, integrity, and availability depends on the specific permissions of the leaked credentials.

Fleet team recommends you: 1. Review your system for potentially leaked credentials. 2. Replace any credentials that may be compromised.

Please consult the associated MITRE ATT&CK - Technique - Disable or Modify Tools for further information about this category of attack.

Patches

To fix this issue, upgrade to a patched version. The updated Fleet deployer filters out labels with the pod-security.kubernetes.io/ prefix when applying namespaceLabels to a namespace. This change preserves the PSS labels set by cluster administrators and prevents them from being overwritten through fleet.yaml or BundleDeployment options.

Patched versions of Fleet include releases v0.15.2, v0.14.6, v0.13.11, and v0.12.15.

Workarounds

If you can’t immediately upgrade to a patched version, use one of the following workarounds:

1 - Deploy NeuVector(primary workaround)

Deploy NeuVector (SUSE Security) and configure an admission control Deny rule for "Run as privileged" in Protect mode. - NeuVector evaluates pod specs independently of Kubernetes PSS namespace labels. It blocks privileged containers even if the labels are downgraded. - Although the namespace labels are still overwritten, the attack cannot exploit confidentiality, integrity, or availability without a privileged pod.

2 - Restrict repository access (secondary workaround)

Note: The following measure reduces the attack surface but does not close the vulnerability: - In a multi-tenant setup, this restriction removes the primary attack vector. However, this measure only reduces the attack surface and doesn't completely close the vulnerability. It may also not be operationally viable for all organizations. ´

Credits

This security issue was reported by the following collaborators according to our responsible disclosure policy:

Radisauskas Arnoldas from NATO and the NATO Cyber Security Centre (NCSC).

References

Reach out to the SUSE Rancher Security team for security related inquiries.
Open an issue in the Rancher repository.
Verify with our support matrix and product support lifecycle.

Severity

8.8 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/rancher/fleet"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.15.0"
            },
            {
              "fixed": "0.15.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/rancher/fleet"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.14.0"
            },
            {
              "fixed": "0.14.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/rancher/fleet"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.13.0"
            },
            {
              "fixed": "0.13.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/rancher/fleet"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.12.0"
            },
            {
              "fixed": "0.12.15"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-44938"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-522"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-01T20:35:37Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Impact\nA vulnerability has been identified in Fleet\u0027s agent-side deployer, which did not filter security-sensitive keys from `namespaceLabels` in `fleet.yaml` (or `BundleDeployment.spec.options.namespaceLabels`) when applying them to the target namespace. \n\nAn attacker with `git push` access to a Fleet-monitored repository could overwrite Pod Security Standards (PSS) enforcement labels on a target namespace. This allows the attacker to weaken admission controls and deploy workloads that PSS policies would otherwise block.\n\n**Important:** The final impact on confidentiality, integrity, and availability depends on the specific permissions of the leaked credentials. \n\nFleet team recommends you:\n1. Review your system for potentially leaked credentials.\n2. Replace any credentials that may be compromised.\n\nPlease consult the associated  [MITRE ATT\u0026CK - Technique - Disable or Modify Tools](https://attack.mitre.org/techniques/T1685/) for further information about this category of attack.\n\n### Patches\nTo fix this issue, upgrade to a patched version. The updated Fleet deployer filters out labels with the `pod-security.kubernetes.io/` prefix when applying `namespaceLabels` to a namespace. This change preserves the PSS labels set by cluster administrators and prevents them from being overwritten through `fleet.yaml` or `BundleDeployment` options.\n\nPatched versions of Fleet include releases `v0.15.2`, `v0.14.6`, `v0.13.11`, and `v0.12.15`.\n\n### Workarounds\nIf you can\u2019t immediately upgrade to a patched version, use one of the following workarounds:\n\n**1 - Deploy NeuVector(primary workaround)**\n\nDeploy NeuVector (SUSE Security) and configure an admission control Deny rule for \"Run as privileged\" in Protect mode. \n- NeuVector evaluates pod specs independently of Kubernetes PSS namespace labels. It blocks privileged containers even if the labels are downgraded. \n- Although the namespace labels are still overwritten, the attack cannot exploit confidentiality, integrity, or availability without a privileged pod.\n\n**2 - Restrict repository access (secondary workaround)**\n\n**Note:** The following measure reduces the attack surface but does not close the vulnerability:\n- In a multi-tenant setup, this restriction removes the primary attack vector. However, this measure only reduces the attack surface and doesn\u0027t completely close the vulnerability. It may also not be operationally viable for all organizations. \u00b4\n\n### Credits\n\nThis security issue was reported by the following collaborators according to our responsible disclosure policy:\n\n- Radisauskas Arnoldas from NATO and the NATO Cyber Security Centre (NCSC).\n\n### References\n- Reach out to the [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy) for security related inquiries.\n- Open an issue in the [Rancher](https://github.com/rancher/rancher/issues/new/choose) repository.\n- Verify with our [support matrix](https://www.suse.com/suse-rancher/support-matrix/all-supported-versions/) and [product support lifecycle](https://www.suse.com/lifecycle/).",
  "id": "GHSA-864g-863m-vcvq",
  "modified": "2026-07-01T20:35:37Z",
  "published": "2026-07-01T20:35:37Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/rancher/fleet/security/advisories/GHSA-864g-863m-vcvq"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/rancher/fleet"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Fleet has PSS Bypass through addLabelsFromOptions in Fleet Agent"
}

WID-SEC-W-2026-1715

Vulnerability from csaf_certbund - Published: 2026-05-27 22:00 - Updated: 2026-05-27 22:00

Summary

Fleet: Mehrere Schwachstellen

Severity

Hoch

Scope

4 vulnerabilities in this advisory, including CVE-2026-44938.

CVE-2026-44938

Known affected: 4 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-44938 (GCVE-0-2026-44938)

FKIE_CVE-2026-44938

GHSA-864G-863M-VCVQ

Impact

Patches

Workarounds

Credits

References

WID-SEC-W-2026-1715

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour