Medium severity · published Sep 28, 2026
CVE-2026-93539
Unauthenticated GitRepo Spec Mutation via Fleet Git Webhook Receiver
5.4
CVSS
0.2%
EPSS
No
On KEV
Description
A vulnerability was discovered in Fleet's Git webhook receiver (the gitjob webhook service). When a webhook secret is not configured, incoming webhook requests are accepted without verification, and processing a request can change the spec.pollingInterval field of a matching GitRepo resource in any namespace. A caller with network access to the webhook service and no Kubernetes credentials can therefore alter GitRepo configuration outside
the namespaces they are authorized for. This only affects SUSE Rancher Fleet 0.16 before 0.16.2, older versions are not affected.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RA
Rancher · SUSE
0.16.0 before 0.16.2 · source: vendor
RF
Rancher Fleet · Suse
0.16.0 before 0.16.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-93539
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-93539
vendor-advisory
https://github.com/rancher/fleet/security/advisories/GHSA-8vfv-33cg-g75q
More from Rancher
9.9
CVE-2026-44935
Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm Deployer
9.9
CVE-2026-41050
Helm impersonation bypass of `RESTClientGetter` retains `cluster-admin` during template rendering
9.9
CVE-2023-22651
Improper Privilege Management vulnerability in SUSE Rancher allows Privilege Escalation
9.9
CVE-2021-36783
A Insufficiently Protected Credentials vulnerability in SUSE Rancher allows authenticated Cluster Owners, Cluster Members, Project Owners and Project Members to read credentials,…
9.9
CVE-2021-36782
A Cleartext Storage of Sensitive Information vulnerability in SUSE Rancher allows authenticated Cluster Owners, Cluster Members, Project Owners, Project Members and User Base to…