CVE-2026-44936
MediumCVSS 5.0Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
In SUSE Rancher Fleet versions 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11, and 0.12 before 0.12.15, missing filtering in the bundle reader when the helmRepoURLRegex field is not set on a GitRepo resource causes Helm authentication credentials (BasicAuth) to be forwarded to any URL specified in the helm.repo field of a fleet.yaml file. This allows attackers with push access to Fleet-monitored git repositories to leak Helm access credentials.
Risk Assessment
The organization risks credential leakage for Helm, which could lead to unauthorized access to Helm repositories and potential supply chain compromise.
Recommendation
Immediately update SUSE Rancher Fleet to version 0.15.2, 0.14.6, 0.13.11, or 0.12.15 depending on the branch in use. Additionally, for existing GitRepo resources, set the helmRepoURLRegex field to restrict allowed Helm repository URLs.
Original NVD description (English source)
Missing filtering when the helmRepoURLRegex field isn't set on a GitRepo resource in SUSE Rancher Fleet's bundle reader in 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.15 forwards Helm authentication credentials (BasicAuth) to any URL specified in the helm.repo field of a fleet.yaml file, allowing attackers able to push to fleet monitored git repos to leak helm access credentials.