Path traversal in Fleet Helm valuesFiles allows disclosure of files outside the bundle directory
A user who can supply bundle content to a repository referenced by a GitRepo resource, for example through Git push access, or through permission to create or modify a GitRepo, can cause SUSE Rancher Fleet to read files from the filesystem of the environment that processes the bundle and include their contents in the generated Bundle resource. This can expose configuration or credential material that the user has no Kubernetes RBAC permission to read, including Helm registry credentials made available to the bundle-processing job when per-path Helm credentials are configured. This affects Fleet 0.16 before 0.16.2, 0.15 before 0.15.7, 0.14 before 0.14.11, 0.13 before 0.13.16, 0.12 before 0.12.20 and potentially older unsupported versions.
CVE-2026-93537
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-93537
Rancher
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://github.com/rancher/fleet/",
"vendor": "SUSE",
"product": "Rancher",
"versions": [
{
"status": "affected",
"version": "0.16.0",
"lessThan": "0.16.2",
"versionType": "semver"
},
{
"status": "affected",
"version": "0.15.0",
"lessThan": "0.15.7",
"versionType": "semver"
},
{
"status": "affected",
"version": "0.14.0",
"lessThan": "0.14.11",
"versionType": "semver"
},
{
"status": "affected",
"version": "0.13.0",
"lessThan": "0.13.16",
"versionType": "semver"
},
{
"status": "affected",
"version": "0.12.0",
"lessThan": "0.12.20",
"versionType": "semver"
}
],
"packageName": "Fleet",
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-93537
Source reference:
/cveMetadata/cveId
Publisher severity
medium
Source reference: /containers/cna/metrics
- Event
- #3279 · Revision 1
- Added to Heist Feed
- Publisher date