Skip to content
CVE PROGRAM SOURCE RECORD9.9 Critical

CVE-2026-44935

Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm Deployer

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
suse

Description

Missing validation of "valuesFrom" references in Helm Deployer of SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.15 could be used by owners of one tenant to access fleet credentials of other tenants.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

SUSE Rancher

Default version status: unaffected

  • 0.15.0 to < 0.15.2affected
  • 0.14.0 to < 0.14.6affected
  • 0.13.0 to < 0.13.11affected
  • 0.12.0 to < 0.12.15affected

References