CVE-2026-41050
Fleet's Helm deployer did not fully apply ServiceAccount impersonation in two code paths, allowing a tenant with git push access to a Fleet-monitored repository to read secrets from any namespace on every downstream cluster targeted by their `GitRepo`.
- CVSS 3.1
- 9.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 32% of CVEs (scores of 2026-10-25)
- CWE
- CWE-863
- Published
- Modified
- Record from
- the NVD, synced
Affected
- suse:rancher_fleet
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-765j-qfrp-hm3j | Go | github.com/rancher/fleet | >=0.15.0 <0.15.1 | 0.15.1 |
| GHSA-765j-qfrp-hm3j | Go | github.com/rancher/fleet | >=0.14.0 <0.14.5 | 0.14.5 |
| GHSA-765j-qfrp-hm3j | Go | github.com/rancher/fleet | >=0.13.0 <0.13.10 | 0.13.10 |
| GHSA-765j-qfrp-hm3j | Go | github.com/rancher/fleet | >=0.12.0 <0.12.14 | 0.12.14 |
| GHSA-765j-qfrp-hm3j | Go | github.com/rancher/fleet | >=0.11.0 <0.11.13 | 0.11.13 |
| GO-2026-5207 | Go | github.com/rancher/fleet | >=0.11.0 <0.11.13 >=0.12.0 <0.12.14 >=0.13.0 <0.13.10 >=0.14.0 <0.14.5 >=0.15.0 <0.15.1 | 0.11.13, 0.12.14, 0.13.10, 0.14.5, 0.15.1 |