CVE-2026-44935 — Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm Deployer

CVE-2026-44935

Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm Deployer PUBLISHED

Description (CNA)

Missing validation of "valuesFrom" references in Helm Deployer of SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.15 could be used by owners of one tenant to access fleet credentials of other tenants.

Affected (CNA)

Vendor / product	Versions
SUSE / Rancher	affected 0.15.0 before 0.15.2; affected 0.14.0 before 0.14.6; affected 0.13.0 before 0.13.11; affected 0.12.0 before 0.12.15

CWE

CWE-1287

References

https://github.com/rancher/fleet/security/advisories/GHSA-xr65-5cpm-g36x

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.