CVE-2026-44936
MediumCVSS 5.0Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
In SUSE Rancher Fleet versions 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11, and 0.12 before 0.12.15, missing filtering in the bundle reader when the helmRepoURLRegex field is not set on a GitRepo resource causes Helm authentication credentials (BasicAuth) to be forwarded to any URL specified in the helm.repo field of a fleet.yaml file. This allows attackers with push access to Fleet-monitored git repositories to leak Helm access credentials.
Risk Assessment
The organization risks credential leakage for Helm, which could lead to unauthorized access to Helm repositories and potential supply chain compromise.
Recommendation
Immediately update SUSE Rancher Fleet to version 0.15.2, 0.14.6, 0.13.11, or 0.12.15 depending on the branch in use. Additionally, for existing GitRepo resources, set the helmRepoURLRegex field to restrict allowed Helm repository URLs.
Other vulnerabilities in SUSE Rancher Fleet
See all- CVE-2026-44935Critical
Missing validation of 'valuesFrom' references in Helm Deployer of SUSE Rancher Fleet allows owners of one tenant to access fleet credentials of other tenants. Affected versions: 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11, and 0.12 before 0.12.15.
- CVE-2026-44937High
A vulnerability in SUSE Rancher Fleet allows forgery of unauthenticated webhook requests, which can be exploited by a remote attacker to cause a denial of service (DoS) or a downgrade attack on other repositories in the system. The issue affects versions 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11, and 0.12 before 0.12.5.
Original NVD description (English source)
Missing filtering when the helmRepoURLRegex field isn't set on a GitRepo resource in SUSE Rancher Fleet's bundle reader in 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.15 forwards Helm authentication credentials (BasicAuth) to any URL specified in the helm.repo field of a fleet.yaml file, allowing attackers able to push to fleet monitored git repos to leak helm access credentials.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS