Critical severity · published Jul 2, 2026
CVE-2026-44935
Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm Deployer
9.9
CVSS
0.5%
EPSS
No
On KEV
Description
Missing validation of "valuesFrom" references in Helm Deployer of SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.15 could be used by owners of one tenant to access fleet credentials of other tenants.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 42% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RA
Rancher · SUSE
0.15.0 before 0.15.2; 0.14.0 before 0.14.6; 0.13.0 before 0.13.11; 0.12.0 before 0.12.15 · source: vendor
RF
Rancher Fleet · Suse
0.12.0 before 0.12.15; 0.13.0 before 0.13.11; 0.14.0 before 0.14.6; 0.15.0 before 0.15.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-44935
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-44935
Vendor Advisory
https://github.com/rancher/fleet/security/advisories/GHSA-xr65-5cpm-g36x
More from Rancher
9.9
CVE-2026-41050
Helm impersonation bypass of `RESTClientGetter` retains `cluster-admin` during template rendering
9.9
CVE-2023-22651
Improper Privilege Management vulnerability in SUSE Rancher allows Privilege Escalation
9.9
CVE-2021-36783
A Insufficiently Protected Credentials vulnerability in SUSE Rancher allows authenticated Cluster Owners, Cluster Members, Project Owners and Project Members to read credentials,…
9.9
CVE-2021-36782
A Cleartext Storage of Sensitive Information vulnerability in SUSE Rancher allows authenticated Cluster Owners, Cluster Members, Project Owners, Project Members and User Base to…
9.8
CVE-2022-43755
A Insufficient Entropy vulnerability in SUSE Rancher allows attackers that gained knowledge of the cattle-token to continue abusing this even after the token was renewed