Aller au contenu
en Se connecter
7.1 Élevée

CVE-2026-93538 A cross-tenant authorization issue was discovered in SUSE Rancher Fleet

Description

A cross-tenant authorization issue was discovered in SUSE Rancher Fleet. During agent-initiated cluster registration, cluster labels supplied by the registering agent, including labels in the reserved management.cattle.io/ namespace such as the cluster display name label, were applied to the resulting upstream Cluster object. Because Fleet resolves GitRepo and Bundle targets from those cluster labels, a party able to register a cluster into a Fleet workspace namespace shared with other tenants could cause its own cluster to satisfy targeting rules that administrators intended for a different cluster. This affects SUSE Rancher Fleet 0.16 before 0.16.1, 0.15 before 0.15.6, 0.14 before 0.14.10, 0.13 before 0.13.15, 0.12 before 0.12.19 and older versions.

Produits et versions touchés

Produit Versions touchées Corrigé en
Rancher 0.16 0.16.0 → < 0.16.1 0.16.1
Rancher 0.15 0.15.0 → < 0.15.6 0.15.6
Rancher 0.14 0.14.0 → < 0.14.10 0.14.10
Rancher 0.13 0.13.0 → < 0.13.15 0.13.15
Rancher 0.12 0.12.0 → < 0.12.19 0.12.19

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Rancher

Les 86 CVE de Rancher →
CVE-2026-88811 Missing filtering in the SUSE Rancher Manager meta proxy could cause passed in rancher credentials to be leaked to cloud… 9.1 Critique CVE-2026-88810 A privilege escalation issue was discovered in Rancher Manager's role-based access control 7.2 Élevée CVE-2026-88809 A security vulnerability exists in the SUSE Rancher Manager meta proxy endpoint (/meta/proxy) 7.6 Élevée CVE-2026-94290 SUSE Rancher Fleet clusters reference a kubeconfig secret that the controller uses to install and manage a Fleet agent… 9.1 Critique
Suivre cette CVE