CVE-2026-44937 — SUSE Rancher Fleet had an Unauthenticated Webhook: Regex Injection via Unsanitized Repository URL Components

CVE-2026-44937

SUSE Rancher Fleet had an Unauthenticated Webhook: Regex Injection via Unsanitized Repository URL Components PUBLISHED

Description (CNA)

Potential forgery of webhook requests when using a unauthenticated webhook in SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.5 could be used by remote attackers to cause a denial of service or a downgrade attack on other repositories on the system.

Affected (CNA)

Vendor / product	Versions
SUSE / Rancher	affected 0.15.0 before 0.15.2; affected 0.14.0 before 0.14.6; affected 0.13.0 before 0.13.11; affected 0.12.0 before 0.12.15

CWE

CWE-918

References

https://github.com/rancher/fleet/security/advisories/GHSA-jmf4-m7j9-g72r

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.