Skip to content
CVE PROGRAM SOURCE RECORD8.8 High

CVE-2026-44938

Fleet has PSS Bypass through addLabelsFromOptions in Fleet Agent

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
suse

Description

A vulnerability has been identified in Fleet's agent-side deployer, which did not filter security-sensitive keys from namespaceLabels in fleet.yaml (or BundleDeployment.spec.options.namespaceLabels) when applying them to the target namespace. An attacker with git push access to a Fleet-monitored repository could overwrite Pod Security Standards (PSS) enforcement labels on a target namespace. This allows the attacker to weaken admission controls and deploy workloads that PSS policies would otherwise block.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

SUSE Rancher

Default version status: unaffected

  • 0.15.0 to < 0.15.2affected
  • 0.14.0 to < 0.14.6affected
  • 0.13.0 to < 0.13.11affected
  • 0.12.0 to < 0.12.15affected

References