CVE-2026-44935

CriticalCVSS 9.9

Published: 02/07/2026(UTC)Updated: 06/07/2026(UTC)Translated: 07/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.57%

43th percentile - higher than 43% of all known CVEs

Summary

Missing validation of 'valuesFrom' references in Helm Deployer of SUSE Rancher Fleet allows owners of one tenant to access fleet credentials of other tenants. Affected versions: 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11, and 0.12 before 0.12.15.

Risk Assessment

The organization is at risk of fleet credential leakage between tenants, potentially leading to unauthorized access to resources and breach of tenant isolation.

Recommendation

Immediately update SUSE Rancher Fleet to version 0.15.2, 0.14.6, 0.13.11, or 0.12.15 depending on the branch in use.

Original NVD description (English source)

Missing validation of "valuesFrom" references in Helm Deployer of SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.15 could be used by owners of one tenant to access fleet credentials of other tenants.