Vulnerability-Lookup

CVE-2026-44936 (GCVE-0-2026-44936)

Vulnerability from cvelistv5 – Published: 2026-07-06 09:30 – Updated: 2026-07-06 12:47

Title

Rancher Fleet SSRF in Bundle Reader via Unvalidated Helm Repository URL in fleet.yaml

Summary

Missing filtering when the helmRepoURLRegex field isn't set on a GitRepo resource in SUSE Rancher Fleet's bundle reader in 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.15 forwards Helm authentication credentials (BasicAuth) to any URL specified in the helm.repo field of a fleet.yaml file, allowing attackers able to push to fleet monitored git repos to leak helm access credentials.

Severity

5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-06 12:47 UTC

CWE

CWE-918 - Server-Side request forgery (SSRF)

Assigner

suse CNA under the mitre root

CNA scorecard B 80/100 over 116 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/advisories/GHSA-hx4v-cxpf-vh8m	vendor-advisory

Impacted products

1 product

Vendor	Product	Version	CPE status
SUSE	Rancher	Affected: 0.15.0 , < 0.15.2 (semver) Affected: 0.14.0 , < 0.14.6 (semver) Affected: 0.13.0 , < 0.13.11 (semver) Affected: 0.12.0 , < 0.12.15 (semver)	guessed

Date Public

2026-05-28 09:28

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-44936",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-06T12:47:38.527371Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-06T12:47:45.102Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "Fleet",
          "product": "Rancher",
          "repo": "https://github.com/rancher/fleet",
          "vendor": "SUSE",
          "versions": [
            {
              "lessThan": "0.15.2",
              "status": "affected",
              "version": "0.15.0",
              "versionType": "semver"
            },
            {
              "lessThan": "0.14.6",
              "status": "affected",
              "version": "0.14.0",
              "versionType": "semver"
            },
            {
              "lessThan": "0.13.11",
              "status": "affected",
              "version": "0.13.0",
              "versionType": "semver"
            },
            {
              "lessThan": "0.12.15",
              "status": "affected",
              "version": "0.12.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2026-05-28T09:28:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Missing filtering when the \u003ccode\u003ehelmRepoURLRegex\u003c/code\u003e field isn\u0027t set on a \u003ccode\u003eGitRepo\u003c/code\u003e resource in SUSE Rancher Fleet\u0027s bundle reader in 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.15 forwards Helm authentication credentials (\u003ccode\u003eBasicAuth\u003c/code\u003e) to any URL specified in the \u003ccode\u003ehelm.repo\u003c/code\u003e field of a \u003ccode\u003efleet.yaml\u003c/code\u003e file, allowing attackers able to push to fleet monitored git repos to leak helm access credentials."
            }
          ],
          "value": "Missing filtering when the helmRepoURLRegex field isn\u0027t set on a GitRepo resource in SUSE Rancher Fleet\u0027s bundle reader in 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.15 forwards Helm authentication credentials (BasicAuth) to any URL specified in the helm.repo field of a fleet.yaml file, allowing attackers able to push to fleet monitored git repos to leak helm access credentials."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-122",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-122 Privilege Abuse"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918 Server-Side request forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-06T09:30:20.688Z",
        "orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
        "shortName": "suse"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/advisories/GHSA-hx4v-cxpf-vh8m"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Rancher Fleet SSRF in Bundle Reader via Unvalidated Helm Repository URL in fleet.yaml",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
    "assignerShortName": "suse",
    "cveId": "CVE-2026-44936",
    "datePublished": "2026-07-06T09:30:20.688Z",
    "dateReserved": "2026-05-08T12:29:48.967Z",
    "dateUpdated": "2026-07-06T12:47:45.102Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-44936",
      "date": "2026-10-29",
      "epss": "0.00348",
      "percentile": "0.28317"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "packageName": "Fleet",
                "product": "Rancher",
                "repo": "https://github.com/rancher/fleet",
                "vendor": "SUSE",
                "versions": [
                  {
                    "lessThan": "0.15.2",
                    "status": "affected",
                    "version": "0.15.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "0.14.6",
                    "status": "affected",
                    "version": "0.14.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "0.13.11",
                    "status": "affected",
                    "version": "0.13.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "0.12.15",
                    "status": "affected",
                    "version": "0.12.0",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "meissner@suse.de"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:suse:rancher_fleet:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8DE7373C-74E0-4B59-AF44-ECB9AC0130B9",
                    "versionEndExcluding": "0.12.15",
                    "versionStartIncluding": "0.12.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:suse:rancher_fleet:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D76AA40B-6291-46DC-BE27-BF4B8F6A8B23",
                    "versionEndExcluding": "0.13.11",
                    "versionStartIncluding": "0.13.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:suse:rancher_fleet:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "F267A8DC-9A24-4A98-B765-CEEC0EBC2576",
                    "versionEndExcluding": "0.14.6",
                    "versionStartIncluding": "0.14.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:suse:rancher_fleet:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "BE1A7C49-CBBF-45BA-91F1-D2DA940BE908",
                    "versionEndExcluding": "0.15.2",
                    "versionStartIncluding": "0.15.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Missing filtering when the helmRepoURLRegex field isn\u0027t set on a GitRepo resource in SUSE Rancher Fleet\u0027s bundle reader in 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.15 forwards Helm authentication credentials (BasicAuth) to any URL specified in the helm.repo field of a fleet.yaml file, allowing attackers able to push to fleet monitored git repos to leak helm access credentials."
          },
          {
            "lang": "es",
            "value": "Falta de filtrado cuando el campo helmRepoURLRegex no est\u00e1 configurado en un recurso GitRepo en el lector de paquetes de SUSE Rancher Fleet en 0.15 antes de 0.15.2, 0.14 antes de 0.14.6, 0.13 antes de 0.13.11 y 0.12 antes de 0.12.15, reenv\u00eda credenciales de autenticaci\u00f3n de Helm (BasicAuth) a cualquier URL especificada en el campo helm.repo de un archivo fleet.yaml, permitiendo a los atacantes capaces de enviar a repositorios Git monitoreados por Fleet filtrar credenciales de acceso de Helm."
          }
        ],
        "id": "CVE-2026-44936",
        "lastModified": "2026-10-25T15:10:00.147",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5.0,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.1,
              "impactScore": 1.4,
              "source": "meissner@suse.de",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5.0,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.1,
              "impactScore": 1.4,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-44936",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-06T12:47:38.527371Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-07-06T11:16:27.610",
        "references": [
          {
            "source": "meissner@suse.de",
            "tags": [
              "Exploit",
              "Third Party Advisory",
              "Mitigation"
            ],
            "url": "https://github.com/advisories/GHSA-hx4v-cxpf-vh8m"
          }
        ],
        "sourceIdentifier": "meissner@suse.de",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-918"
              }
            ],
            "source": "meissner@suse.de",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-44936",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-06T12:47:38.527371Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-06T12:47:41.781Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "packageName": "Fleet",
              "product": "Rancher",
              "repo": "https://github.com/rancher/fleet",
              "vendor": "SUSE",
              "versions": [
                {
                  "lessThan": "0.15.2",
                  "status": "affected",
                  "version": "0.15.0",
                  "versionType": "semver"
                },
                {
                  "lessThan": "0.14.6",
                  "status": "affected",
                  "version": "0.14.0",
                  "versionType": "semver"
                },
                {
                  "lessThan": "0.13.11",
                  "status": "affected",
                  "version": "0.13.0",
                  "versionType": "semver"
                },
                {
                  "lessThan": "0.12.15",
                  "status": "affected",
                  "version": "0.12.0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "datePublic": "2026-05-28T09:28:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Missing filtering when the \u003ccode\u003ehelmRepoURLRegex\u003c/code\u003e field isn\u0027t set on a \u003ccode\u003eGitRepo\u003c/code\u003e resource in SUSE Rancher Fleet\u0027s bundle reader in 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.15 forwards Helm authentication credentials (\u003ccode\u003eBasicAuth\u003c/code\u003e) to any URL specified in the \u003ccode\u003ehelm.repo\u003c/code\u003e field of a \u003ccode\u003efleet.yaml\u003c/code\u003e file, allowing attackers able to push to fleet monitored git repos to leak helm access credentials."
                }
              ],
              "value": "Missing filtering when the helmRepoURLRegex field isn\u0027t set on a GitRepo resource in SUSE Rancher Fleet\u0027s bundle reader in 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.15 forwards Helm authentication credentials (BasicAuth) to any URL specified in the helm.repo field of a fleet.yaml file, allowing attackers able to push to fleet monitored git repos to leak helm access credentials."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-122",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-122 Privilege Abuse"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-918",
                  "description": "CWE-918 Server-Side request forgery (SSRF)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-06T09:30:20.688Z",
            "orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
            "shortName": "suse"
          },
          "references": [
            {
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://github.com/advisories/GHSA-hx4v-cxpf-vh8m"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Rancher Fleet SSRF in Bundle Reader via Unvalidated Helm Repository URL in fleet.yaml",
          "x_generator": {
            "engine": "Vulnogram 1.0.2"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
        "assignerShortName": "suse",
        "cveId": "CVE-2026-44936",
        "datePublished": "2026-07-06T09:30:20.688Z",
        "dateReserved": "2026-05-08T12:29:48.967Z",
        "dateUpdated": "2026-07-06T12:47:45.102Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-44936

Vulnerability from fkie_nvd - Published: 2026-07-06 11:16 - Updated: 2026-10-25 15:10

Severity

5.0 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
5.0 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Summary

References

	URL	Tags
	meissner@suse.de	https://github.com/advisories/GHSA-hx4v-cxpf-vh8m	Exploit, Third Party Advisory, Mitigation

Impacted products

Vendor	Product	Version
suse	rancher_fleet	*
suse	rancher_fleet	*
suse	rancher_fleet	*
suse	rancher_fleet	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "packageName": "Fleet",
          "product": "Rancher",
          "repo": "https://github.com/rancher/fleet",
          "vendor": "SUSE",
          "versions": [
            {
              "lessThan": "0.15.2",
              "status": "affected",
              "version": "0.15.0",
              "versionType": "semver"
            },
            {
              "lessThan": "0.14.6",
              "status": "affected",
              "version": "0.14.0",
              "versionType": "semver"
            },
            {
              "lessThan": "0.13.11",
              "status": "affected",
              "version": "0.13.0",
              "versionType": "semver"
            },
            {
              "lessThan": "0.12.15",
              "status": "affected",
              "version": "0.12.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "meissner@suse.de"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:suse:rancher_fleet:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "8DE7373C-74E0-4B59-AF44-ECB9AC0130B9",
              "versionEndExcluding": "0.12.15",
              "versionStartIncluding": "0.12.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:suse:rancher_fleet:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D76AA40B-6291-46DC-BE27-BF4B8F6A8B23",
              "versionEndExcluding": "0.13.11",
              "versionStartIncluding": "0.13.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:suse:rancher_fleet:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F267A8DC-9A24-4A98-B765-CEEC0EBC2576",
              "versionEndExcluding": "0.14.6",
              "versionStartIncluding": "0.14.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:suse:rancher_fleet:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "BE1A7C49-CBBF-45BA-91F1-D2DA940BE908",
              "versionEndExcluding": "0.15.2",
              "versionStartIncluding": "0.15.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Missing filtering when the helmRepoURLRegex field isn\u0027t set on a GitRepo resource in SUSE Rancher Fleet\u0027s bundle reader in 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.15 forwards Helm authentication credentials (BasicAuth) to any URL specified in the helm.repo field of a fleet.yaml file, allowing attackers able to push to fleet monitored git repos to leak helm access credentials."
    },
    {
      "lang": "es",
      "value": "Falta de filtrado cuando el campo helmRepoURLRegex no est\u00e1 configurado en un recurso GitRepo en el lector de paquetes de SUSE Rancher Fleet en 0.15 antes de 0.15.2, 0.14 antes de 0.14.6, 0.13 antes de 0.13.11 y 0.12 antes de 0.12.15, reenv\u00eda credenciales de autenticaci\u00f3n de Helm (BasicAuth) a cualquier URL especificada en el campo helm.repo de un archivo fleet.yaml, permitiendo a los atacantes capaces de enviar a repositorios Git monitoreados por Fleet filtrar credenciales de acceso de Helm."
    }
  ],
  "id": "CVE-2026-44936",
  "lastModified": "2026-10-25T15:10:00.147",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.0,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 1.4,
        "source": "meissner@suse.de",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.0,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 1.4,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-44936",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-07-06T12:47:38.527371Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-07-06T11:16:27.610",
  "references": [
    {
      "source": "meissner@suse.de",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "Mitigation"
      ],
      "url": "https://github.com/advisories/GHSA-hx4v-cxpf-vh8m"
    }
  ],
  "sourceIdentifier": "meissner@suse.de",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ],
      "source": "meissner@suse.de",
      "type": "Secondary"
    }
  ]
}

GHSA-HX4V-CXPF-VH8M

Vulnerability from github – Published: 2026-07-01 20:45 – Updated: 2026-07-01 20:45

Summary

Rancher Fleet has SSRF in Bundle Reader via Unvalidated Helm Repository URL in fleet.yaml

Details

Impact

A vulnerability has been identified in Fleet when the helmRepoURLRegex field isn't set on a GitRepo resource. Fleet's bundle reader forwards Helm authentication credentials (BasicAuth) to any URL specified in the helm.repo field of a fleet.yaml file.

An attacker with git push access to a Fleet-monitored repository can exploit this behavior by specifying a malicious URL in helm.repo. This causes the Fleet controller to send the configured Helm repository credentials to the attacker’s server.

As a result, the attacker can capture the username and password that an administrator configured to access a private Helm chart repository. However, the response body from the attacker's server isn't included in the error message (this behavior was fixed in Fleet v0.13.3 and later), which prevents additional internal data from leaking through the status condition.

The final severity of this vulnerability depends on the specific permissions of the leaked credentials.

Fleet recommends you to: 1. Review your system for potentially leaked credentials. 2. Replace any credentials that might be compromised.

Please consult the associated MITRE ATT&CK - Technique - Stored Data Manipulation and MITRE ATT&CK - Technique - Steal Application Access Token for further information about this category of attack.

Patches

To resolve this vulnerability, upgrade to a patched version of Fleet. The patched version of Fleet now requires you to set the helmRepoURLRegex field on the GitRepo. If the helmRepoURLRegex is empty or missing, Fleet won’t send credentials, regardless of the URL specified in fleet.yaml.

When you upgrade, a Helm pre-upgrade job automatically migrates existing GitRepo resources that have helmSecretName or helmSecretNameForPaths configured but lack a helmRepoURLRegex. The migration job performs the following actions:

The job extracts the scheme and host from the Helm repository URLs already stored in the resource's Bundles. For example, a GitRepo with Bundles referencing https://charts.example.com/stable receives helmRepoURLRegex: "^https://charts\.example\.com/". This limits credential forwarding to the origins already in use before the upgrade. Migrated resources are annotated with fleet.cattle.io/helm-regex-auto-migrated: "true" so you can easily audit them.

If no Bundles with Helm repository URLs exist during the migration (for example, if the GitRepo has never successfully synced), helmRepoURLRegex remains empty and credentials aren't forwarded. You must set this field manually before Fleet will send credentials.

The migration job runs only once per installation and records its status in a ConfigMap named fleet-helm-url-regex-migrated in the Fleet system namespace. Any GitRepo resources you create after the upgrade require an explicit helmRepoURLRegex to forward credentials.

Patched versions of Fleet include releases v0.15.2, v0.14.6, 0.13.11, and v0.12.15.

Workarounds

If you cannot immediately upgrade to a patched version, use the following methods to mitigate the risk and audit your environment. Set helmRepoURLRegex on all GitRepo resources that use helmSecretName. Ensure the regular expression matches only your legitimate Helm repository URL.

Example configuration:

apiVersion: fleet.cattle.io/v1alpha1
kind: GitRepo
metadata:
  name: my-app
  namespace: fleet-local
spec:
  repo: https://git.example.com/org/my-app.git
  helmSecretName: helm-creds
  helmRepoURLRegex: "^https://charts\\.example\\.com/.*"

After upgrading to a patched version, review all auto-migrated GitRepo resources by running the following command:

kubectl get gitrepo -A -o json | \
  jq -r '.items[] | select(.metadata.annotations["fleet.cattle.io/helm-regex-auto-migrated"] == "true") | "\(.metadata.namespace)/\(.metadata.name): \(.spec.helmRepoURLRegex)"'

Verify that the auto-derived regular expression matches only your intended Helm repository origins. If a regular expression is broader than necessary, replace it with a more specific pattern.

Credits

This security issue was reported by the following collaborators according to our responsible disclosure policy:

Radisauskas Arnoldas from NATO and the NATO Cyber Security Centre (NCSC).
FluentLogic's security team.

References

If you have any questions or comments about this advisory: - Reach out to the SUSE Rancher Security team for security related inquiries. - Open an issue in the Rancher repository. - Verify with our support matrix and product support lifecycle.

Severity

5.0 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/rancher/fleet"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.15.0"
            },
            {
              "fixed": "0.15.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/rancher/fleet"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.14.0"
            },
            {
              "fixed": "0.14.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/rancher/fleet"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.13.0"
            },
            {
              "fixed": "0.13.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/rancher/fleet"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.12.0"
            },
            {
              "fixed": "0.12.15"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-44936"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-01T20:45:05Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Impact\nA vulnerability has been identified in Fleet when the `helmRepoURLRegex` field isn\u0027t set on a `GitRepo` resource. Fleet\u0027s bundle reader forwards Helm authentication credentials (`BasicAuth`) to any URL specified in the `helm.repo` field of a `fleet.yaml` file.\n\nAn attacker with git push access to a Fleet-monitored repository can exploit this behavior by specifying a malicious URL in `helm.repo`. This causes the Fleet controller to send the configured Helm repository credentials to the attacker\u2019s server. \n\nAs a result, the attacker can capture the username and password that an administrator configured to access a private Helm chart repository. However, the response body from the attacker\u0027s server isn\u0027t included in the error message (this behavior was fixed in Fleet `v0.13.3` and later), which prevents additional internal data from leaking through the status condition.\n\nThe final severity of this vulnerability depends on the specific permissions of the leaked credentials. \n\nFleet recommends you to:\n1. Review your system for potentially leaked credentials.\n2. Replace any credentials that might be compromised.\n\nPlease consult the associated [MITRE ATT\u0026CK - Technique - Stored Data Manipulation](https://attack.mitre.org/techniques/T1565/001/) and [MITRE ATT\u0026CK - Technique - Steal Application Access Token](https://attack.mitre.org/techniques/T1528/) for further information about this category of attack.\n\n### Patches\nTo resolve this vulnerability, upgrade to a patched version of Fleet. The patched version of Fleet now requires you to set the `helmRepoURLRegex` field on the `GitRepo`. If the `helmRepoURLRegex` is empty or missing, Fleet won\u2019t send credentials, regardless of the URL specified in `fleet.yaml`.\n \nWhen you upgrade, a Helm pre-upgrade job automatically migrates existing `GitRepo` resources that have `helmSecretName` or `helmSecretNameForPaths` configured but lack a `helmRepoURLRegex`. The migration job performs the following actions:\n\nThe job extracts the scheme and host from the Helm repository URLs already stored in the resource\u0027s Bundles. For example, a `GitRepo` with Bundles referencing `https://charts.example.com/stable` receives `helmRepoURLRegex: \"^https://charts\\.example\\.com/\"`. This limits credential forwarding to the origins already in use before the upgrade.\nMigrated resources are annotated with `fleet.cattle.io/helm-regex-auto-migrated: \"true\"` so you can easily audit them.\n\nIf no Bundles with Helm repository URLs exist during the migration (for example, if the `GitRepo` has never successfully synced), `helmRepoURLRegex` remains empty and credentials aren\u0027t forwarded. You must set this field manually before Fleet will send credentials.\n\nThe migration job runs only once per installation and records its status in a `ConfigMap` named `fleet-helm-url-regex-migrated` in the Fleet system namespace. Any `GitRepo` resources you create after the upgrade require an explicit `helmRepoURLRegex` to forward credentials.\n\nPatched versions of Fleet include releases `v0.15.2`, `v0.14.6`, `0.13.11`, and `v0.12.15`.\n\n### Workarounds\nIf you cannot immediately upgrade to a patched version, use the following methods to mitigate the risk and audit your environment.\nSet `helmRepoURLRegex` on all `GitRepo` resources that use `helmSecretName`. Ensure the regular expression matches only your legitimate Helm repository URL. \n\nExample configuration:\n```yaml\napiVersion: fleet.cattle.io/v1alpha1\nkind: GitRepo\nmetadata:\n  name: my-app\n  namespace: fleet-local\nspec:\n  repo: https://git.example.com/org/my-app.git\n  helmSecretName: helm-creds\n  helmRepoURLRegex: \"^https://charts\\\\.example\\\\.com/.*\"\n```\n\nAfter upgrading to a patched version, review all auto-migrated `GitRepo` resources by running the following command:\n\n``` \nkubectl get gitrepo -A -o json | \\\n  jq -r \u0027.items[] | select(.metadata.annotations[\"fleet.cattle.io/helm-regex-auto-migrated\"] == \"true\") | \"\\(.metadata.namespace)/\\(.metadata.name): \\(.spec.helmRepoURLRegex)\"\u0027\n```\n\nVerify that the auto-derived regular expression matches only your intended Helm repository origins. If a regular expression is broader than necessary, replace it with a more specific pattern.\n\n### Credits\n\nThis security issue was reported by the following collaborators according to our responsible disclosure policy:\n\n- Radisauskas Arnoldas from NATO and the NATO Cyber Security Centre (NCSC).\n- FluentLogic\u0027s security team.\n\n### References\nIf you have any questions or comments about this advisory:\n- Reach out to the [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy) for security related inquiries.\n- Open an issue in the [Rancher](https://github.com/rancher/rancher/issues/new/choose) repository.\n- Verify with our [support matrix](https://www.suse.com/suse-rancher/support-matrix/all-supported-versions/) and [product support lifecycle](https://www.suse.com/lifecycle/).",
  "id": "GHSA-hx4v-cxpf-vh8m",
  "modified": "2026-07-01T20:45:05Z",
  "published": "2026-07-01T20:45:05Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/rancher/fleet/security/advisories/GHSA-hx4v-cxpf-vh8m"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/rancher/fleet"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Rancher Fleet has SSRF in Bundle Reader via Unvalidated Helm Repository URL in fleet.yaml"
}

WID-SEC-W-2026-1715

Vulnerability from csaf_certbund - Published: 2026-05-27 22:00 - Updated: 2026-05-27 22:00

Summary

Fleet: Mehrere Schwachstellen

Severity

Hoch

Scope

4 vulnerabilities in this advisory, including CVE-2026-44936.

CVE-2026-44936

Known affected: 4 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-44936 (GCVE-0-2026-44936)

FKIE_CVE-2026-44936

GHSA-HX4V-CXPF-VH8M

Impact

Patches

Workarounds

Credits

References

WID-SEC-W-2026-1715

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour