Skip to content
CVE PROGRAM SOURCE RECORD9.9 Critical

CVE-2026-41050

Helm impersonation bypass of `RESTClientGetter` retains `cluster-admin` during template rendering

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
suse

Description

Fleet's Helm deployer did not fully apply ServiceAccount impersonation in two code paths, allowing a tenant with git push access to a Fleet-monitored repository to read secrets from any namespace on every downstream cluster targeted by their `GitRepo`.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

SUSE Rancher

Default version status: unaffected

  • 0.15.0 to < 0.15.1affected
  • 0.14.0 to < 0.14.5affected
  • 0.13.0 to < 0.13.10affected
  • 0.12.0 to < 0.12.14affected
  • 0.11.0 to < 0.11.13affected

References