Vulnerability · Published Sep 28, 2026 · Assigned by suse

CVE-2026-93539Unauthenticated GitRepo Spec Mutation via Fleet Git Webhook Receiver

Medium 5.4

In plain English

A medium-severity missing authentication in Rancher from SUSE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.2%top 85.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability was discovered in Fleet's Git webhook receiver (the gitjob webhook service). When a webhook secret is not configured, incoming webhook requests are accepted without verification, and processing a request can change the spec.pollingInterval field of a matching GitRepo resource in any namespace. A caller with network access to the webhook service and no Kubernetes credentials can therefore alter GitRepo configuration outside the namespaces they are authorized for. This only affects SUSE Rancher Fleet 0.16 before 0.16.2, older versions are not affected.

Affected products (as reported)

Vendor	Product	Versions
SUSE	Rancher	0.16.0 – before 0.16.2

Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

References

https://github.com/rancher/fleet/security/advisories/GHSA-8vfv-33cg-g75q vendor-advisory