{"cve":"CVE-2026-41050","nvd":{"published":"2026-05-13T08:16:16.780","modified":"2026-10-20T16:07:19.077","status":"Analyzed","description":"Fleet's Helm deployer did not fully apply ServiceAccount impersonation in two code paths, allowing a tenant with git push access to a Fleet-monitored repository to read secrets from any namespace on every downstream cluster targeted by their `GitRepo`.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","score":9.9},"cwes":["CWE-863"],"references":["https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-41050","https://github.com/advisories/GHSA-765j-qfrp-hm3j"],"products":["suse:rancher_fleet"],"source":"nvd","synced_at":"2026-10-21T03:43:09.190223697+00:00"},"epss":{"cve":"CVE-2026-41050","score":0.0039,"percentile":0.32873,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-765j-qfrp-hm3j","url":"https://osv.dev/vulnerability/GHSA-765j-qfrp-hm3j","summary":"Fleet: Helm impersonation bypass of `RESTClientGetter` retains `cluster-admin` during template rendering","modified":"2026-06-25T19:56:22.698371981Z","packages":[{"ecosystem":"Go","name":"github.com/rancher/fleet","purl":"pkg:golang/github.com/rancher/fleet","ranges":[">=0.15.0 <0.15.1"],"fixed":["0.15.1"]},{"ecosystem":"Go","name":"github.com/rancher/fleet","purl":"pkg:golang/github.com/rancher/fleet","ranges":[">=0.14.0 <0.14.5"],"fixed":["0.14.5"]},{"ecosystem":"Go","name":"github.com/rancher/fleet","purl":"pkg:golang/github.com/rancher/fleet","ranges":[">=0.13.0 <0.13.10"],"fixed":["0.13.10"]},{"ecosystem":"Go","name":"github.com/rancher/fleet","purl":"pkg:golang/github.com/rancher/fleet","ranges":[">=0.12.0 <0.12.14"],"fixed":["0.12.14"]},{"ecosystem":"Go","name":"github.com/rancher/fleet","purl":"pkg:golang/github.com/rancher/fleet","ranges":[">=0.11.0 <0.11.13"],"fixed":["0.11.13"]}]},{"id":"GO-2026-5207","url":"https://osv.dev/vulnerability/GO-2026-5207","summary":"Fleet: Helm impersonation bypass of `RESTClientGetter` retains `cluster-admin` during template rendering in github.com/rancher/fleet","modified":"2026-06-25T19:45:15.332308930Z","packages":[{"ecosystem":"Go","name":"github.com/rancher/fleet","purl":"pkg:golang/github.com/rancher/fleet","ranges":[">=0.11.0 <0.11.13",">=0.12.0 <0.12.14",">=0.13.0 <0.13.10",">=0.14.0 <0.14.5",">=0.15.0 <0.15.1"],"fixed":["0.11.13","0.12.14","0.13.10","0.14.5","0.15.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}