Paper/Archive/CVE-2026-44935

CVE-2026-44935

SUSE Rancher — Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm Deployer

EPSS 0.5%CVSS 9.9

critical.is priorityof 100

CVSS 9.9 (CNA)9.9 / 10 × 3029.7 Not in CISA KEV+300.0 EPSS percentile 42.2.422 × 208.4 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Missing validation of "valuesFrom" references in Helm Deployer of SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.15 could be used by owners of one tenant to access fleet credentials of other tenants.

Affected

ProductAffectedFixed inSource

Rancher0.15.0 – < 0.15.20.15.2CNA

Rancher0.14.0 – < 0.14.60.14.6CNA

Rancher0.13.0 – < 0.13.110.13.11CNA

Rancher0.12.0 – < 0.12.150.12.15CNA

Scores by source

suse (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

advisorygithub.com/rancher/fleet/security/advisories/GHSA-xr65-5cpm-g36x