{"id":"CVE-2026-104615","state":"PUBLISHED","title":"Cluster identity takeover in Fleet cluster registration allows access to another cluster's Fleet namespace","description":"A security vulnerability was discovered in SUSE Rancher Fleet's cluster registration flow, in Fleet versions before 0.12, 0.13.0 up to 0.13.17, 0.14.0 up to 0.14.12, 0.15.0 up t o 0.15.17 and 0.16.0 up to 0.16.3. The cluster identity claimed by a registration request was accepted without being bound to the registration token that the request was made with. As a result, a registration request could be associated with a managed cluster that was originally registered with a different registration token.","publishedAt":"2026-10-30T15:49:01.402Z","updatedAt":"2026-10-30T15:49:01.402Z","severity":{"score":7.9,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:H","source":"suse"},"assigner":"suse","products":["SUSE Rancher"],"affected":[{"vendor":"SUSE","product":"Rancher","packageName":"Fleett","defaultStatus":"unaffected","versions":[{"version":"0.16.0","status":"affected","lessThan":"0.16.3","versionType":"semver"},{"version":"0.15.0.","status":"affected","lessThan":"0.15.17","versionType":"semver"},{"version":"0.14.0","status":"affected","lessThan":"0.14.12","versionType":"semver"},{"version":"0.13","status":"affected","lessThan":"0.13.17","versionType":"semver"},{"version":"0","status":"affected","lessThanOrEqual":"0.12","versionType":"semver"}],"repo":"https://github.com/rancher/fleet/"}],"references":["https://github.com/rancher/fleet/security/advisories/GHSA-gx8v-2929-9q95"],"weaknesses":["CWE-290"],"ingestedAt":"2026-10-30T15:58:06.618Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/104xxx/CVE-2026-104615.json","commit":"2b1b837cd89354d9c9a57d56e0640dc825b19235","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-104615","state":"PUBLISHED","datePublished":"2026-10-30T15:49:01.402Z","dateUpdated":"2026-10-30T15:49:01.402Z","assignerShortName":"suse","assignerOrgId":"404e59f5-483d-4b8a-8e7a-e67604dd8afb","dateReserved":"2026-10-02T04:18:56.078Z"},"containers":{"cna":{"title":"Cluster identity takeover in Fleet cluster registration allows access to another cluster's Fleet namespace","descriptions":[{"lang":"en","value":"A security vulnerability was discovered in SUSE Rancher Fleet's cluster registration flow, in Fleet versions before 0.12, 0.13.0 up to 0.13.17, 0.14.0 up to 0.14.12, 0.15.0 up t o 0.15.17 and 0.16.0 up to 0.16.3. The cluster identity claimed by a registration request was accepted without being bound to the registration token that the request was made with. As a result, a registration request could be associated with a managed cluster that was originally registered with a different registration token."}],"affected":[{"vendor":"SUSE","product":"Rancher","packageName":"Fleett","defaultStatus":"unaffected","versions":[{"version":"0.16.0","status":"affected","lessThan":"0.16.3","versionType":"semver"},{"version":"0.15.0.","status":"affected","lessThan":"0.15.17","versionType":"semver"},{"version":"0.14.0","status":"affected","lessThan":"0.14.12","versionType":"semver"},{"version":"0.13","status":"affected","lessThan":"0.13.17","versionType":"semver"},{"version":"0","status":"affected","lessThanOrEqual":"0.12","versionType":"semver"}],"repo":"https://github.com/rancher/fleet/"}],"references":[{"url":"https://github.com/rancher/fleet/security/advisories/GHSA-gx8v-2929-9q95","tags":["vendor-advisory"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"HIGH","baseSeverity":"HIGH","baseScore":7.9,"vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:H"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-290","lang":"en","description":"CWE-290 Authentication bypass by spoofing","type":"CWE"}]}],"providerMetadata":{"shortName":"suse","orgId":"404e59f5-483d-4b8a-8e7a-e67604dd8afb","dateUpdated":"2026-10-30T15:49:01.402Z"},"datePublic":"2026-10-30T15:44:00.000Z","impacts":[{"capecId":"CAPEC-233","descriptions":[{"lang":"en","value":"CAPEC-233 Privilege Escalation"}]}],"cpeApplicability":[{"operator":"OR","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*","versionStartIncluding":"0.16.0","versionEndExcluding":"0.16.3"},{"vulnerable":true,"criteria":"cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*","versionStartIncluding":"0.15.0.","versionEndExcluding":"0.15.17"},{"vulnerable":true,"criteria":"cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*","versionStartIncluding":"0.14.0","versionEndExcluding":"0.14.12"},{"vulnerable":true,"criteria":"cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*","versionStartIncluding":"0.13","versionEndExcluding":"0.13.17"},{"vulnerable":true,"criteria":"cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*","versionStartIncluding":"0","versionEndIncluding":"0.12"}]}]}],"credits":[{"lang":"en","value":"https://github.com/Pig-Tail","type":"finder"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 1.0.5"}}}}}