CVE-2026-41050 — Helm impersonation bypass of `RESTClientGetter` retains `cluster-admin` during template rendering

CVE-2026-41050

Helm impersonation bypass of `RESTClientGetter` retains `cluster-admin` during template rendering PUBLISHED

Description (CNA)

Fleet's Helm deployer did not fully apply ServiceAccount impersonation in two code paths, allowing a tenant with git push access to a Fleet-monitored repository to read secrets from any namespace on every downstream cluster targeted by their `GitRepo`.

Affected (CNA)

Vendor / product	Versions
SUSE / Rancher	affected 0.15.0 before 0.15.1; affected 0.14.0 before 0.14.5; affected 0.13.0 before 0.13.10; affected 0.12.0 before 0.12.14; affected 0.11.0 before 0.11.13

CWE

CWE-863

References

https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-41050
https://github.com/advisories/GHSA-765j-qfrp-hm3j

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.