CVE-2026-44937
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
A vulnerability in SUSE Rancher Fleet allows forgery of unauthenticated webhook requests, which can be exploited by a remote attacker to cause a denial of service (DoS) or a downgrade attack on other repositories in the system. The issue affects versions 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11, and 0.12 before 0.12.5.
Risk Assessment
The organization is at risk of service disruption and potential compromise of repository integrity through unauthorized modifications, which could lead to availability loss or introduction of unsafe changes in software.
Recommendation
Immediately upgrade SUSE Rancher Fleet to version 0.15.2, 0.14.6, 0.13.11, or 0.12.5 depending on the branch in use. Additionally, enable authentication for webhooks and restrict access to webhook endpoints.
Original NVD description (English source)
Potential forgery of webhook requests when using a unauthenticated webhook in SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.5 could be used by remote attackers to cause a denial of service or a downgrade attack on other repositories on the system.