Medium severity · published Jul 6, 2026
CVE-2026-44936
Rancher Fleet SSRF in Bundle Reader via Unvalidated Helm Repository URL in fleet.yaml
5.0
CVSS
0.3%
EPSS
No
On KEV
Description
Missing filtering when the helmRepoURLRegex field isn't set on a GitRepo resource in SUSE Rancher Fleet's bundle reader in 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.15 forwards Helm authentication credentials (BasicAuth) to any URL specified in the helm.repo field of a fleet.yaml file, allowing attackers able to push to fleet monitored git repos to leak helm access credentials.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RA
Rancher · SUSE
0.15.0 before 0.15.2; 0.14.0 before 0.14.6; 0.13.0 before 0.13.11; 0.12.0 before 0.12.15 · source: vendor
RF
Rancher Fleet · Suse
0.12.0 before 0.12.15; 0.13.0 before 0.13.11; 0.14.0 before 0.14.6; 0.15.0 before 0.15.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-44936
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-44936
Exploit
https://github.com/advisories/GHSA-hx4v-cxpf-vh8m
More from Rancher
9.9
CVE-2026-44935
Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm Deployer
9.9
CVE-2026-41050
Helm impersonation bypass of `RESTClientGetter` retains `cluster-admin` during template rendering
9.9
CVE-2025-62878
Local Path Provisioner vulnerable to Path Traversal via parameters.pathPattern
9.9
CVE-2023-22651
Improper Privilege Management vulnerability in SUSE Rancher allows Privilege Escalation
9.9
CVE-2021-36783
A Insufficiently Protected Credentials vulnerability in SUSE Rancher allows authenticated Cluster Owners, Cluster Members, Project Owners and Project Members to read credentials,…