by Kastro
Paper/Archive/CVE-2026-41050

CVE-2026-41050

SUSE Rancher — Helm impersonation bypass of `RESTClientGetter` retains `cluster-admin` during template rendering

EPSS 0.4%CVSS 9.9
critical.is priorityof 100
36
CVSS 9.9 (CNA)9.9 / 10 × 3029.7Not in CISA KEV+300.0EPSS percentile 33.2.332 × 206.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Fleet's Helm deployer did not fully apply ServiceAccount impersonation in two code paths, allowing a tenant with git push access to a Fleet-monitored repository to read secrets from any namespace on every downstream cluster targeted by their `GitRepo`.

Affected

ProductAffectedFixed inSource
Rancher0.15.0 – < 0.15.10.15.1CNA
Rancher0.14.0 – < 0.14.50.14.5CNA
Rancher0.13.0 – < 0.13.100.13.10CNA
Rancher0.12.0 – < 0.12.140.12.14CNA
Rancher0.11.0 – < 0.11.130.11.13CNA

Scores by source

suse (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refbugzilla.suse.com/show_bug.cgi?id=CVE-2026-41050refgithub.com/advisories/GHSA-765j-qfrp-hm3j