Skip to content
CVE PROGRAM SOURCE RECORD7.1 High

CVE-2026-93538

Cross-tenant BundleDeployment and Secret disclosure via spoofed cluster labels during agent-initiated registration in Fleet

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
suse

Description

A cross-tenant authorization issue was discovered in SUSE Rancher Fleet. During agent-initiated cluster registration, cluster labels supplied by the registering agent, including labels in the reserved management.cattle.io/ namespace such as the cluster display name label, were applied to the resulting upstream Cluster object. Because Fleet resolves GitRepo and Bundle targets from those cluster labels, a party able to register a cluster into a Fleet workspace namespace shared with other tenants could cause its own cluster to satisfy targeting rules that administrators intended for a different cluster. This affects SUSE Rancher Fleet 0.16 before 0.16.1, 0.15 before 0.15.6, 0.14 before 0.14.10, 0.13 before 0.13.15, 0.12 before 0.12.19 and older versions.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

SUSE Rancher

Default version status: unaffected

  • 0.16.0 to < 0.16.1affected
  • 0.15.0 to < 0.15.6affected
  • 0.14.0 to < 0.14.10affected
  • 0.13.0 to < 0.13.15affected
  • 0.12.0 to < 0.12.19affected

References