Unauthenticated GitRepo Spec Mutation via Fleet Git Webhook Receiver
A vulnerability was discovered in Fleet's Git webhook receiver (the gitjob webhook service). When a webhook secret is not configured, incoming webhook requests are accepted without verification, and processing a request can change the spec.pollingInterval field of a matching GitRepo resource in any namespace. A caller with network access to the webhook service and no Kubernetes credentials can therefore alter GitRepo configuration outside the namespaces they are authorized for. This only affects SUSE Rancher Fleet 0.16 before 0.16.2, older versions are not affected.
CVE-2026-93539
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-93539
Rancher
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://github.com/rancher/fleet/",
"vendor": "SUSE",
"product": "Rancher",
"versions": [
{
"status": "affected",
"version": "0.16.0",
"lessThan": "0.16.2",
"versionType": "semver"
}
],
"packageName": "Fleet",
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-93539
Source reference:
/cveMetadata/cveId
Publisher severity
medium
Source reference: /containers/cna/metrics
- Event
- #3188 · Revision 1
- Added to Heist Feed
- Publisher date