Suse Rancher Fleet vulnerabilities

9 CVEs affecting Suse Rancher Fleet, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-88808, published 2026-09-28.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-44935, published 2026-07-02. Critical severity, CVSS 9.9. EPSS: 0.5% chance of exploitation in the next 30 days. Missing validation of "valuesFrom" references in Helm Deployer of SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.15 could be used by owners of one…
CVE-2026-44937, published 2026-07-06. High severity, CVSS 8.2. EPSS: 0.4% chance of exploitation in the next 30 days. Potential forgery of webhook requests when using a unauthenticated webhook in SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.5 could be used by…
CVE-2026-44936, published 2026-07-06. Medium severity, CVSS 5.0. EPSS: 0.3% chance of exploitation in the next 30 days. Missing filtering when the helmRepoURLRegex field isn't set on a GitRepo resource in SUSE Rancher Fleet's bundle reader in 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before…
CVE-2026-93537, published 2026-09-28. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. A user who can supply bundle content to a repository referenced by a GitRepo resource, for example through Git push access, or through permission to create or modify a GitRepo, can cause SUSE Rancher…
CVE-2026-88808, published 2026-09-28. High severity, CVSS 8.8. EPSS: 0.3% chance of exploitation in the next 30 days. A vulnerability has been identified within Rancher Manager where the Fleet agent wrote resources to downstream clusters using its own cluster-admin credentials instead of the ServiceAccount pinned to…
CVE-2026-93539, published 2026-09-28. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. A vulnerability was discovered in Fleet's Git webhook receiver (the gitjob webhook service). When a webhook secret is not configured, incoming webhook requests are accepted without verification, and…
CVE-2026-93540, published 2026-09-28. Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days. A privilege mismatch was found in Fleet. When a bundle requested namespace labels or annotations through the namespaceLabels and namespaceAnnotations options, the resulting namespace metadata update…
CVE-2026-93538, published 2026-09-28. High severity, CVSS 7.1. EPSS: 0.2% chance of exploitation in the next 30 days. A cross-tenant authorization issue was discovered in SUSE Rancher Fleet. During agent-initiated cluster registration, cluster labels supplied by the registering agent, including labels in the…
CVE-2026-75036, published 2026-09-03. Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days. A security vulnerability was discovered in Fleet's Helm template preprocessing where templates evaluated by the Fleet controller could reach network resources outside the management cluster. A user…