Skip to content
fr Sign in
9.9 Critical

CVE-2026-41050 Fleet's Helm deployer did not fully apply ServiceAccount impersonation in two code paths, allowing a tenant with git…

Description

Fleet's Helm deployer did not fully apply ServiceAccount impersonation in two code paths, allowing a tenant with git push access to a Fleet-monitored repository to read secrets from any namespace on every downstream cluster targeted by their `GitRepo`.

Affected products and versions

Product Affected versions Fixed in
Rancher 0.15 0.15.0 → < 0.15.1 0.15.1
Rancher 0.14 0.14.0 → < 0.14.5 0.14.5
Rancher 0.13 0.13.0 → < 0.13.10 0.13.10
Rancher 0.12 0.12.0 → < 0.12.14 0.12.14
Rancher 0.11 0.11.0 → < 0.11.13 0.11.13

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Rancher

The 86 CVEs of Rancher →
CVE-2026-88811 Missing filtering in the SUSE Rancher Manager meta proxy could cause passed in rancher credentials to be leaked to cloud… 9.1 Critical CVE-2026-88810 A privilege escalation issue was discovered in Rancher Manager's role-based access control 7.2 High CVE-2026-88809 A security vulnerability exists in the SUSE Rancher Manager meta proxy endpoint (/meta/proxy) 7.6 High CVE-2026-94290 SUSE Rancher Fleet clusters reference a kubeconfig secret that the controller uses to install and manage a Fleet agent… 9.1 Critical
Track this CVE