CVE-2026-44935

Critical · CVSS 9.9

SUSE Rancher Fleet — Missing input validation leading to cross-tenant credential access (CWE-1287)

CVSS: 9.9; nvd
EPSS: 0.57%; 43th pct
KEV: No
Class: other; CWE-1287

Description

Missing validation of "valuesFrom" references in Helm Deployer of SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.15 could be used by owners of one tenant to access fleet credentials of other tenants.

Search profile — drives PoC discovery

Symbols valuesFromHelm Deployerfleet credentialsHelmReleasevaluesFrom referencesGitRepoBundleDeployment

Keywords CVE-2026-44935GHSA-xr65-5cpm-g36xRancher Fleet valuesFromFleet Helm Deployer tenant escapeFleet cross-tenant credential accessFleet valuesFrom validation bypassrancher fleet 0.15rancher fleet 0.14rancher fleet 0.13rancher fleet 0.12Fleet HelmDeployer credential leak

Versions: 0.15.0–0.15.1, 0.14.0–0.14.5, 0.13.0–0.13.10, 0.12.0–0.12.14

References

https://github.com/rancher/fleet/security/advisories/GHSA-xr65-5cpm-g36x

Status: enriched · ingested 2026-07-06T18:00:39.000Z · profiled 2026-07-06T18:30:39.000Z