CRITICAL9.9CVE-2026-44935Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm Deployer in github.com/rancher/fleet >= 0.15.0, < 0.15.2
CRITICAL9.9CVE-2026-44935Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm Deployer in github.com/rancher/fleet >= 0.12.0, < 0.12.15, >= 0.13.0, < 0.13.11, >= 0.14.0, < 0.14.6, >= 0.15.0, < 0.15.2
CRITICAL9.9CVE-2026-41050Fleet: Helm impersonation bypass of `RESTClientGetter` retains `cluster-admin` during template rendering in github.com/rancher/fleet >= 0.15.0, < 0.15.1
CRITICAL9.9Fleet: Helm impersonation bypass of `RESTClientGetter` retains `cluster-admin` during template rendering in github.com/rancher/fleet
>= 0.11.0, < 0.11.13, >= 0.12.0, < 0.12.14, >= 0.13.0, < 0.13.10, >= 0.14.0, < 0.14.5, >= 0.15.0, < 0.15.1
HIGH8.8Fleet has PSS Bypass through addLabelsFromOptions in Fleet Agent in github.com/rancher/fleet
>= 0.15.0, < 0.15.2
HIGH8.8Fleet has PSS Bypass through addLabelsFromOptions in Fleet Agent in github.com/rancher/fleet
>= 0.12.0, < 0.12.15, >= 0.13.0, < 0.13.11, >= 0.14.0, < 0.14.6, >= 0.15.0, < 0.15.2
HIGH7.7Rancher Fleet Helm Values are stored inside BundleDeployment in plain text in github.com/rancher/fleet
>= 0.13.0, < 0.13.1-0.20250806151509-088bcbea7edb
HIGH7.7Rancher Fleet Helm Values are stored inside BundleDeployment in plain text in github.com/rancher/fleet
>= 0.11.0, < 0.11.10, >= 0.12.0, < 0.12.6, >= 0.13.0, < 0.13.1-0.20250806151509-088bcbea7edb
HIGH7.5Rancher Fleet has Unauthenticated Webhook: Regex Injection via Unsanitized Repository URL Components in github.com/rancher/fleet
>= 0.15.0, < 0.15.2
HIGH7.5Rancher Fleet has Unauthenticated Webhook: Regex Injection via Unsanitized Repository URL Components in github.com/rancher/fleet
>= 0.12.0, < 0.12.15, >= 0.13.0, < 0.13.11, >= 0.14.0, < 0.14.6, >= 0.15.0, < 0.15.2
MEDIUM6.3Fleet doesn’t validate a server’s certificate when connecting through SSH in github.com/rancher/fleet
>= 0.9.0-rc.1, < 0.10.12
MEDIUM6.3Fleet doesn’t validate a server’s certificate when connecting through SSH in github.com/rancher/fleet
>= 0.9.0-rc.1, < 0.10.12, >= 0.11.0, < 0.11.7, >= 0.12.0, < 0.12.2
MEDIUM5.0Rancher Fleet has SSRF in Bundle Reader via Unvalidated Helm Repository URL in fleet.yaml in github.com/rancher/fleet
>= 0.15.0, < 0.15.2
MEDIUM5.0Rancher Fleet has SSRF in Bundle Reader via Unvalidated Helm Repository URL in fleet.yaml in github.com/rancher/fleet
>= 0.12.0, < 0.12.15, >= 0.13.0, < 0.13.11, >= 0.14.0, < 0.14.6, >= 0.15.0, < 0.15.2