Login Request a demo
RF
Product
Rancher Fleet
by Suse · last CVE Sep 28, 2026
12
CVEs
0
On KEV
9.9
Max CVSS
5
New 30D
Vulnerabilities12In the news0Timeline
Severity mix
Critical 2High 4Medium 6Low 0
Severity
All severities12Critical2High4Medium6Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Rancher Fleet to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-44935
9.9
0%
Jul 2
Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm Deployer
Affected: 0.12.0 before 0.12.15; 0.13.0 before 0.13.11; 0.14.0 before 0.14.6; 0.15.0 before 0.15.2
CVE-2026-41050
9.9
0%
May 13
Helm impersonation bypass of `RESTClientGetter` retains `cluster-admin` during template rendering
Affected: 0.11.0 before 0.11.13; 0.12.0 before 0.12.14; 0.13.0 before 0.13.10; 0.14.0 before 0.14.5; 0.15.0 before 0.15.1
CVE-2026-88808
8.8
0%
Sep 28
Fleet agent copies downstream resources with cluster-admin privileges, allowing cross-namespace writes on downstream clusters
Affected: 0.14.0 before 0.14.11; 0.15.0 before 0.15.7; 0.16.0 before 0.16.2
CVE-2026-44938
8.8
0%
Jul 7
Fleet has PSS Bypass through addLabelsFromOptions in Fleet Agent
Affected: 0.12.0 before 0.12.15; 0.13.0 before 0.13.11; 0.14.0 before 0.14.6; 0.15.0 before 0.15.2
CVE-2026-44937
8.2
0%
Jul 6
SUSE Rancher Fleet had an Unauthenticated Webhook: Regex Injection via Unsanitized Repository URL Components
Affected: 0.12.0 before 0.12.15; 0.13.0 before 0.13.11; 0.14.0 before 0.14.6; 0.15.0 before 0.15.2
CVE-2026-93538
7.1
0%
Sep 28
Cross-tenant BundleDeployment and Secret disclosure via spoofed cluster labels during agent-initiated registration in Fleet
Affected: 0.12.0 before 0.12.19; 0.13.0 before 0.13.15; 0.14.0 before 0.14.10; 0.15.0 before 0.15.6; 0.16.0 before 0.16.1
CVE-2026-93540
6.5
0%
Sep 28
Fleet applies namespace labels and annotations without the bundle's service account privileges
Affected: 0.13.0 before 0.13.16; 0.14.0 before 0.14.11; 0.15.0 before 0.15.7; 0.16.0 before 0.16.1
CVE-2026-93537
6.5
0%
Sep 28
Path traversal in Fleet Helm valuesFiles allows disclosure of files outside the bundle directory
Affected: 0.12.0 before 0.12.20; 0.13.0 before 0.13.16; 0.14.0 before 0.14.11; 0.15.0 before 0.15.7; 0.16.0 before 0.16.2
CVE-2026-93539
5.4
0%
Sep 28
Unauthenticated GitRepo Spec Mutation via Fleet Git Webhook Receiver
Affected: 0.16.0 before 0.16.2
CVE-2026-44936
5.0
0%
Jul 6
Rancher Fleet SSRF in Bundle Reader via Unvalidated Helm Repository URL in fleet.yaml
Affected: 0.12.0 before 0.12.15; 0.13.0 before 0.13.11; 0.14.0 before 0.14.6; 0.15.0 before 0.15.2
CVE-2026-44948
4.9
0%
Jun 30
Path Traversal in Rancher Fleet ImageScan GitRepo Path Handler
Affected: 0.12.0 before 0.12.16; 0.13.0 before 0.13.12; 0.14.0 before 0.14.7; 0.15.0 before 0.15.3
CVE-2026-75036
4.3
0%
Sep 3
Fleet: DNS exfiltration via Sprig getHostByName in fleet.yaml Helm template preprocessing
Affected: 0.12.0 before 0.12.19; 0.13.0 before 0.13.15; 0.14.0 before 0.14.10; 0.15.0 before 0.15.6; 0.16.0 before 0.16.1
Showing 12