Vulnerability · Published Jul 6, 2026 · Assigned by suse
CVE-2026-44936Rancher Fleet SSRF in Bundle Reader via Unvalidated Helm Repository URL in fleet.yaml
Medium 5.0
In plain English
A medium-severity server-side request forgery in Rancher from SUSE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Missing filtering when the helmRepoURLRegex field isn't set on a GitRepo resource in SUSE Rancher Fleet's bundle reader in 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.15 forwards Helm authentication credentials (BasicAuth) to any URL specified in the helm.repo field of a fleet.yaml file, allowing attackers able to push to fleet monitored git repos to leak helm access credentials.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/rancher/fleet | 0.15.2 | GHSA-hx4v-cxpf-vh8m |
| Go | github.com/rancher/fleet | 0.14.6 | GHSA-hx4v-cxpf-vh8m |
| Go | github.com/rancher/fleet | 0.13.11 | GHSA-hx4v-cxpf-vh8m |
| Go | github.com/rancher/fleet | 0.12.15 | GHSA-hx4v-cxpf-vh8m |
| Go | github.com/rancher/fleet | 0.12.15, 0.13.11, 0.14.6, 0.15.2 | GO-2026-5873 |
Affected products (as reported)
Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
References
- https://github.com/advisories/GHSA-hx4v-cxpf-vh8m vendor-advisory