Vulnerability · Published May 13, 2026 · Assigned by suse
CVE-2026-41050Helm impersonation bypass of `RESTClientGetter` retains `cluster-admin` during template rendering
Critical 9.9
In plain English
A critical-severity incorrect authorization in Rancher from SUSE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)9.9Critical
Exploit odds (30 days)0.4%top 66.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Fleet's Helm deployer did not fully apply ServiceAccount impersonation in two code paths, allowing a tenant with git push access to a Fleet-monitored repository to read secrets from any namespace on every downstream cluster targeted by their `GitRepo`.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/rancher/fleet | 0.15.1 | GHSA-765j-qfrp-hm3j |
| Go | github.com/rancher/fleet | 0.14.5 | GHSA-765j-qfrp-hm3j |
| Go | github.com/rancher/fleet | 0.13.10 | GHSA-765j-qfrp-hm3j |
| Go | github.com/rancher/fleet | 0.12.14 | GHSA-765j-qfrp-hm3j |
| Go | github.com/rancher/fleet | 0.11.13 | GHSA-765j-qfrp-hm3j |
| Go | github.com/rancher/fleet | 0.11.13, 0.12.14, 0.13.10, 0.14.5, 0.15.1 | GO-2026-5207 |
Affected products (as reported)
Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H