{"schema_version":"2","view":"grouped","data":[{"id":32573,"cve_ids":["CVE-2024-22031"],"payload":{"kind":"advisory","title":"Rancher users who can create Projects can gain access to arbitrary projects","summary":"A vulnerability has been identified within Rancher where a user with the ability to create a project, on a certain cluster, can create a project with the same name as an existing project in a different cluster. This results in the user gaining access to the other project in the different cluster, resulting in a privilege escalation. This happens because the namespace used on the local cluster to store related resources (PRTBs and secrets) is the name of the project.","evidence":"cve:CVE-2024-22031","products":[{"name":{"value":"rancher","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2024-22031","aliases":["CVE-2024-22031"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":8.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"SUSE","product":"rancher","versions":[{"status":"affected","version":"2.8.0","lessThan":"2.9.9","versionType":"semver"},{"status":"affected","version":"2.10.0","lessThan":"2.10.5","versionType":"semver"},{"status":"affected","version":"2.11.0","lessThan":"2.11.1","versionType":"semver"}],"packageName":"github.com/rancher/rancher","defaultStatus":"unaffected"}],"modified":"2026-10-16T03:56:35.364Z","provider":"cve","references":["https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-22031","https://github.com/rancher/rancher/security/advisories/GHSA-8h6m-wv39-239m"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-22031","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-15T00:00:00+00:00"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-16T03:56:35.364Z"}}],"cna":{"orgId":"404e59f5-483d-4b8a-8e7a-e67604dd8afb","shortName":"suse","dateUpdated":"2026-10-15T08:21:02.222Z"}}},"related_cves":[{"value":"CVE-2024-22031","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:1ae68963-8b25-49ff-a008-e9be9f02aa86","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-22031","advisory_id":"1ae68963-8b25-49ff-a008-e9be9f02aa86","event_types":["advisory"],"published_at":"2026-10-25T08:47:09.816817+00:00","technologies":["core-cve","rancher"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-15T08:21:02.222+00:00","detail_url":"/advisories/advisory%3A1ae68963-8b25-49ff-a008-e9be9f02aa86","group":{"id":"advisory:1ae68963-8b25-49ff-a008-e9be9f02aa86","revision":1,"primary_event_id":32304,"change":"published","superseded_by":[],"changed":{"id":32304,"cve_ids":["CVE-2024-22031"],"payload":{"kind":"advisory","title":"Rancher users who can create Projects can gain access to arbitrary projects","summary":"A vulnerability has been identified within Rancher where a user with the ability to create a project, on a certain cluster, can create a project with the same name as an existing project in a different cluster. This results in the user gaining access to the other project in the different cluster, resulting in a privilege escalation. This happens because the namespace used on the local cluster to store related resources (PRTBs and secrets) is the name of the project.","evidence":"cve:CVE-2024-22031","products":[{"name":{"value":"rancher","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2024-22031","aliases":["CVE-2024-22031"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":8.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"SUSE","product":"rancher","versions":[{"status":"affected","version":"2.8.0","lessThan":"2.9.9","versionType":"semver"},{"status":"affected","version":"2.10.0","lessThan":"2.10.5","versionType":"semver"},{"status":"affected","version":"2.11.0","lessThan":"2.11.1","versionType":"semver"}],"packageName":"github.com/rancher/rancher","defaultStatus":"unaffected"}],"modified":"2026-10-16T03:56:35.364Z","provider":"cve","references":["https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-22031","https://github.com/rancher/rancher/security/advisories/GHSA-8h6m-wv39-239m"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-22031","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-15T00:00:00+00:00"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-16T03:56:35.364Z"}}],"cna":{"orgId":"404e59f5-483d-4b8a-8e7a-e67604dd8afb","shortName":"suse","dateUpdated":"2026-10-15T08:21:02.222Z"}}},"related_cves":[{"value":"CVE-2024-22031","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:1ae68963-8b25-49ff-a008-e9be9f02aa86","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-22031","advisory_id":"1ae68963-8b25-49ff-a008-e9be9f02aa86","event_types":["advisory"],"published_at":"2026-10-25T08:47:09.816817+00:00","technologies":["core-cve","rancher"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-15T08:21:02.222+00:00","detail_url":"/events/32304"},"members":[{"id":32304,"cve_ids":["CVE-2024-22031"],"payload":{"kind":"advisory","title":"Rancher users who can create Projects can gain access to arbitrary projects","summary":"A vulnerability has been identified within Rancher where a user with the ability to create a project, on a certain cluster, can create a project with the same name as an existing project in a different cluster. This results in the user gaining access to the other project in the different cluster, resulting in a privilege escalation. This happens because the namespace used on the local cluster to store related resources (PRTBs and secrets) is the name of the project.","evidence":"cve:CVE-2024-22031","products":[{"name":{"value":"rancher","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2024-22031","aliases":["CVE-2024-22031"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":8.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"SUSE","product":"rancher","versions":[{"status":"affected","version":"2.8.0","lessThan":"2.9.9","versionType":"semver"},{"status":"affected","version":"2.10.0","lessThan":"2.10.5","versionType":"semver"},{"status":"affected","version":"2.11.0","lessThan":"2.11.1","versionType":"semver"}],"packageName":"github.com/rancher/rancher","defaultStatus":"unaffected"}],"modified":"2026-10-16T03:56:35.364Z","provider":"cve","references":["https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-22031","https://github.com/rancher/rancher/security/advisories/GHSA-8h6m-wv39-239m"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-22031","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-15T00:00:00+00:00"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-16T03:56:35.364Z"}}],"cna":{"orgId":"404e59f5-483d-4b8a-8e7a-e67604dd8afb","shortName":"suse","dateUpdated":"2026-10-15T08:21:02.222Z"}}},"related_cves":[{"value":"CVE-2024-22031","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:1ae68963-8b25-49ff-a008-e9be9f02aa86","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-22031","advisory_id":"1ae68963-8b25-49ff-a008-e9be9f02aa86","event_types":["advisory"],"published_at":"2026-10-25T08:47:09.816817+00:00","technologies":["core-cve","rancher"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-15T08:21:02.222+00:00","detail_url":"/events/32304"}]}},{"id":3395,"cve_ids":["CVE-2026-88808"],"payload":{"kind":"advisory","title":"Fleet agent copies downstream resources with cluster-admin privileges, allowing cross-namespace writes on downstream clusters","summary":"A vulnerability has been identified within Rancher Manager where the Fleet agent wrote resources to downstream clusters using its own cluster-admin credentials instead of the ServiceAccount pinned to the deployment. It affects multi-tenancy environments where different tenants share the same downstream clusters, for example different privileged or untrusted teams inside the same organization. This could lead to overwritten configuration files. This issue affected SUSE Rancher Fleet 0.16 before 0.16.2, 0.15 before 0.15.7, and 0.14 before 0.14.11.","evidence":"cve:CVE-2026-88808","products":[{"name":{"value":"Rancher","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-88808","aliases":["CVE-2026-88808"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/rancher/fleet/","vendor":"SUSE","product":"Rancher","versions":[{"status":"affected","version":"0.16.0","lessThan":"0.16.2","versionType":"semver"},{"status":"affected","version":"0.15.0","lessThan":"0.15.7","versionType":"semver"},{"status":"affected","version":"0.14.0","lessThan":"0.14.11","versionType":"semver"}],"packageName":"Fleet","defaultStatus":"unaffected"}],"modified":"2026-09-29T03:55:24.347Z","provider":"cve","references":["https://github.com/rancher/fleet/security/advisories/GHSA-q9v4-358v-r8q5"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-88808","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-28T00:00:00+00:00"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-29T03:55:24.347Z"}}],"cna":{"orgId":"404e59f5-483d-4b8a-8e7a-e67604dd8afb","shortName":"suse","dateUpdated":"2026-09-28T15:36:13.506Z"}}},"related_cves":[{"value":"CVE-2026-88808","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:101987da-b1ae-4b53-9a43-3d168666ea6f","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-88808","advisory_id":"101987da-b1ae-4b53-9a43-3d168666ea6f","event_types":["advisory"],"published_at":"2026-10-24T21:34:23.929232+00:00","technologies":["core-cve","rancher"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T15:36:13.506+00:00","detail_url":"/advisories/advisory%3A101987da-b1ae-4b53-9a43-3d168666ea6f","group":{"id":"advisory:101987da-b1ae-4b53-9a43-3d168666ea6f","revision":1,"primary_event_id":3413,"change":"published","superseded_by":[],"changed":{"id":3413,"cve_ids":["CVE-2026-88808"],"payload":{"kind":"advisory","title":"Fleet agent copies downstream resources with cluster-admin privileges, allowing cross-namespace writes on downstream clusters","summary":"A vulnerability has been identified within Rancher Manager where the Fleet agent wrote resources to downstream clusters using its own cluster-admin credentials instead of the ServiceAccount pinned to the deployment. It affects multi-tenancy environments where different tenants share the same downstream clusters, for example different privileged or untrusted teams inside the same organization. This could lead to overwritten configuration files. This issue affected SUSE Rancher Fleet 0.16 before 0.16.2, 0.15 before 0.15.7, and 0.14 before 0.14.11.","evidence":"cve:CVE-2026-88808","products":[{"name":{"value":"Rancher","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-88808","aliases":["CVE-2026-88808"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/rancher/fleet/","vendor":"SUSE","product":"Rancher","versions":[{"status":"affected","version":"0.16.0","lessThan":"0.16.2","versionType":"semver"},{"status":"affected","version":"0.15.0","lessThan":"0.15.7","versionType":"semver"},{"status":"affected","version":"0.14.0","lessThan":"0.14.11","versionType":"semver"}],"packageName":"Fleet","defaultStatus":"unaffected"}],"modified":"2026-09-29T03:55:24.347Z","provider":"cve","references":["https://github.com/rancher/fleet/security/advisories/GHSA-q9v4-358v-r8q5"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-88808","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-28T00:00:00+00:00"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-29T03:55:24.347Z"}}],"cna":{"orgId":"404e59f5-483d-4b8a-8e7a-e67604dd8afb","shortName":"suse","dateUpdated":"2026-09-28T15:36:13.506Z"}}},"related_cves":[{"value":"CVE-2026-88808","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:101987da-b1ae-4b53-9a43-3d168666ea6f","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-88808","advisory_id":"101987da-b1ae-4b53-9a43-3d168666ea6f","event_types":["advisory"],"published_at":"2026-10-24T21:34:23.929232+00:00","technologies":["core-cve","rancher"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T15:36:13.506+00:00","detail_url":"/events/3413"},"members":[{"id":3413,"cve_ids":["CVE-2026-88808"],"payload":{"kind":"advisory","title":"Fleet agent copies downstream resources with cluster-admin privileges, allowing cross-namespace writes on downstream clusters","summary":"A vulnerability has been identified within Rancher Manager where the Fleet agent wrote resources to downstream clusters using its own cluster-admin credentials instead of the ServiceAccount pinned to the deployment. It affects multi-tenancy environments where different tenants share the same downstream clusters, for example different privileged or untrusted teams inside the same organization. This could lead to overwritten configuration files. This issue affected SUSE Rancher Fleet 0.16 before 0.16.2, 0.15 before 0.15.7, and 0.14 before 0.14.11.","evidence":"cve:CVE-2026-88808","products":[{"name":{"value":"Rancher","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-88808","aliases":["CVE-2026-88808"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/rancher/fleet/","vendor":"SUSE","product":"Rancher","versions":[{"status":"affected","version":"0.16.0","lessThan":"0.16.2","versionType":"semver"},{"status":"affected","version":"0.15.0","lessThan":"0.15.7","versionType":"semver"},{"status":"affected","version":"0.14.0","lessThan":"0.14.11","versionType":"semver"}],"packageName":"Fleet","defaultStatus":"unaffected"}],"modified":"2026-09-29T03:55:24.347Z","provider":"cve","references":["https://github.com/rancher/fleet/security/advisories/GHSA-q9v4-358v-r8q5"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-88808","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-28T00:00:00+00:00"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-29T03:55:24.347Z"}}],"cna":{"orgId":"404e59f5-483d-4b8a-8e7a-e67604dd8afb","shortName":"suse","dateUpdated":"2026-09-28T15:36:13.506Z"}}},"related_cves":[{"value":"CVE-2026-88808","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:101987da-b1ae-4b53-9a43-3d168666ea6f","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-88808","advisory_id":"101987da-b1ae-4b53-9a43-3d168666ea6f","event_types":["advisory"],"published_at":"2026-10-24T21:34:23.929232+00:00","technologies":["core-cve","rancher"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T15:36:13.506+00:00","detail_url":"/events/3413"}]}},{"id":3393,"cve_ids":["CVE-2026-88805"],"payload":{"kind":"advisory","title":"Session Not Revoked Server-Side on Logout in Rancher","summary":"Incorrect credential cleaning on logout could be used by remote attackers to keep access credentials even after the account was logged out. Affected is SUSE Rancher 2.15 before 2.15.2.","evidence":"cve:CVE-2026-88805","products":[{"name":{"value":"Rancher","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-88805","aliases":["CVE-2026-88805"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/rancher/rancher/","vendor":"SUSE","product":"Rancher","versions":[{"status":"affected","version":"2.15.0","lessThan":"2.15.2","versionType":"semver"}],"packageName":"Rancher","defaultStatus":"unaffected"}],"modified":"2026-09-29T03:55:25.070Z","provider":"cve","references":["https://github.com/rancher/rancher/security/advisories/GHSA-6vpq-mf48-9794"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-88805","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-28T00:00:00+00:00"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-29T03:55:25.070Z"}}],"cna":{"orgId":"404e59f5-483d-4b8a-8e7a-e67604dd8afb","shortName":"suse","dateUpdated":"2026-09-28T15:50:34.591Z"}}},"related_cves":[{"value":"CVE-2026-88805","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:4cbee567-3a62-4f1a-8914-779d01fee3d2","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-88805","advisory_id":"4cbee567-3a62-4f1a-8914-779d01fee3d2","event_types":["advisory"],"published_at":"2026-10-24T21:34:23.315973+00:00","technologies":["core-cve","rancher"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T15:50:34.591+00:00","detail_url":"/advisories/advisory%3A4cbee567-3a62-4f1a-8914-779d01fee3d2","group":{"id":"advisory:4cbee567-3a62-4f1a-8914-779d01fee3d2","revision":1,"primary_event_id":3411,"change":"published","superseded_by":[],"changed":{"id":3411,"cve_ids":["CVE-2026-88805"],"payload":{"kind":"advisory","title":"Session Not Revoked Server-Side on Logout in Rancher","summary":"Incorrect credential cleaning on logout could be used by remote attackers to keep access credentials even after the account was logged out. Affected is SUSE Rancher 2.15 before 2.15.2.","evidence":"cve:CVE-2026-88805","products":[{"name":{"value":"Rancher","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-88805","aliases":["CVE-2026-88805"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/rancher/rancher/","vendor":"SUSE","product":"Rancher","versions":[{"status":"affected","version":"2.15.0","lessThan":"2.15.2","versionType":"semver"}],"packageName":"Rancher","defaultStatus":"unaffected"}],"modified":"2026-09-29T03:55:25.070Z","provider":"cve","references":["https://github.com/rancher/rancher/security/advisories/GHSA-6vpq-mf48-9794"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-88805","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-28T00:00:00+00:00"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-29T03:55:25.070Z"}}],"cna":{"orgId":"404e59f5-483d-4b8a-8e7a-e67604dd8afb","shortName":"suse","dateUpdated":"2026-09-28T15:50:34.591Z"}}},"related_cves":[{"value":"CVE-2026-88805","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:4cbee567-3a62-4f1a-8914-779d01fee3d2","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-88805","advisory_id":"4cbee567-3a62-4f1a-8914-779d01fee3d2","event_types":["advisory"],"published_at":"2026-10-24T21:34:23.315973+00:00","technologies":["core-cve","rancher"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T15:50:34.591+00:00","detail_url":"/events/3411"},"members":[{"id":3411,"cve_ids":["CVE-2026-88805"],"payload":{"kind":"advisory","title":"Session Not Revoked Server-Side on Logout in Rancher","summary":"Incorrect credential cleaning on logout could be used by remote attackers to keep access credentials even after the account was logged out. Affected is SUSE Rancher 2.15 before 2.15.2.","evidence":"cve:CVE-2026-88805","products":[{"name":{"value":"Rancher","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-88805","aliases":["CVE-2026-88805"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/rancher/rancher/","vendor":"SUSE","product":"Rancher","versions":[{"status":"affected","version":"2.15.0","lessThan":"2.15.2","versionType":"semver"}],"packageName":"Rancher","defaultStatus":"unaffected"}],"modified":"2026-09-29T03:55:25.070Z","provider":"cve","references":["https://github.com/rancher/rancher/security/advisories/GHSA-6vpq-mf48-9794"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-88805","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-28T00:00:00+00:00"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-29T03:55:25.070Z"}}],"cna":{"orgId":"404e59f5-483d-4b8a-8e7a-e67604dd8afb","shortName":"suse","dateUpdated":"2026-09-28T15:50:34.591Z"}}},"related_cves":[{"value":"CVE-2026-88805","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:4cbee567-3a62-4f1a-8914-779d01fee3d2","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-88805","advisory_id":"4cbee567-3a62-4f1a-8914-779d01fee3d2","event_types":["advisory"],"published_at":"2026-10-24T21:34:23.315973+00:00","technologies":["core-cve","rancher"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T15:50:34.591+00:00","detail_url":"/events/3411"}]}},{"id":3275,"cve_ids":["CVE-2026-88804"],"payload":{"kind":"advisory","title":"Unauthenticated update of public UI settings leading to stored cross-site scripting in Rancher","summary":"An unauthenticated update of public UI settings could be used by remote attackers to execute a stored cross-site scripting attack in the Rancher UI, in SUSE Rancher 2.15 before 2.15.2, 2.14 before 2.14.6, 2.13 before 2.13.10, 2.12 before 2.12.14 and 2.11 before 2.11.18.","evidence":"cve:CVE-2026-88804","products":[{"name":{"value":"Rancher","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-88804","aliases":["CVE-2026-88804"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":9.6,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/rancher/rancher/","vendor":"SUSE","product":"Rancher","versions":[{"status":"affected","version":"2.15.0","lessThan":"2.15.2","versionType":"semver"},{"status":"affected","version":"2.14.0","lessThan":"2.14.6","versionType":"semver"},{"status":"affected","version":"2.13.0","lessThan":"2.13.10","versionType":"semver"},{"status":"affected","version":"2.12.0","lessThan":"2.12.14","versionType":"semver"},{"status":"affected","version":"2.11.0se","lessThan":"2.11.18","versionType":"semver"}],"packageName":"Rancher","defaultStatus":"unaffected"}],"modified":"2026-09-28T18:02:56.882Z","provider":"cve","references":["https://github.com/rancher/rancher/security/advisories/GHSA-992f-xh8r-jg2f"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-88804","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-28T16:31:06.472253Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T18:02:56.882Z"}}],"cna":{"orgId":"404e59f5-483d-4b8a-8e7a-e67604dd8afb","shortName":"suse","dateUpdated":"2026-09-28T15:58:34.657Z"}}},"related_cves":[{"value":"CVE-2026-88804","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:fd9ce621-3a6a-46d7-aa1d-a86fc501f40e","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-88804","advisory_id":"fd9ce621-3a6a-46d7-aa1d-a86fc501f40e","event_types":["advisory"],"published_at":"2026-10-24T21:32:10.942851+00:00","technologies":["core-cve","rancher"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T15:58:34.657+00:00","detail_url":"/advisories/advisory%3Afd9ce621-3a6a-46d7-aa1d-a86fc501f40e","group":{"id":"advisory:fd9ce621-3a6a-46d7-aa1d-a86fc501f40e","revision":1,"primary_event_id":3287,"change":"published","superseded_by":[],"changed":{"id":3287,"cve_ids":["CVE-2026-88804"],"payload":{"kind":"advisory","title":"Unauthenticated update of public UI settings leading to stored cross-site scripting in Rancher","summary":"An unauthenticated update of public UI settings could be used by remote attackers to execute a stored cross-site scripting attack in the Rancher UI, in SUSE Rancher 2.15 before 2.15.2, 2.14 before 2.14.6, 2.13 before 2.13.10, 2.12 before 2.12.14 and 2.11 before 2.11.18.","evidence":"cve:CVE-2026-88804","products":[{"name":{"value":"Rancher","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-88804","aliases":["CVE-2026-88804"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":9.6,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/rancher/rancher/","vendor":"SUSE","product":"Rancher","versions":[{"status":"affected","version":"2.15.0","lessThan":"2.15.2","versionType":"semver"},{"status":"affected","version":"2.14.0","lessThan":"2.14.6","versionType":"semver"},{"status":"affected","version":"2.13.0","lessThan":"2.13.10","versionType":"semver"},{"status":"affected","version":"2.12.0","lessThan":"2.12.14","versionType":"semver"},{"status":"affected","version":"2.11.0se","lessThan":"2.11.18","versionType":"semver"}],"packageName":"Rancher","defaultStatus":"unaffected"}],"modified":"2026-09-28T18:02:56.882Z","provider":"cve","references":["https://github.com/rancher/rancher/security/advisories/GHSA-992f-xh8r-jg2f"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-88804","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-28T16:31:06.472253Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T18:02:56.882Z"}}],"cna":{"orgId":"404e59f5-483d-4b8a-8e7a-e67604dd8afb","shortName":"suse","dateUpdated":"2026-09-28T15:58:34.657Z"}}},"related_cves":[{"value":"CVE-2026-88804","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:fd9ce621-3a6a-46d7-aa1d-a86fc501f40e","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-88804","advisory_id":"fd9ce621-3a6a-46d7-aa1d-a86fc501f40e","event_types":["advisory"],"published_at":"2026-10-24T21:32:10.942851+00:00","technologies":["core-cve","rancher"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T15:58:34.657+00:00","detail_url":"/events/3287"},"members":[{"id":3287,"cve_ids":["CVE-2026-88804"],"payload":{"kind":"advisory","title":"Unauthenticated update of public UI settings leading to stored cross-site scripting in Rancher","summary":"An unauthenticated update of public UI settings could be used by remote attackers to execute a stored cross-site scripting attack in the Rancher UI, in SUSE Rancher 2.15 before 2.15.2, 2.14 before 2.14.6, 2.13 before 2.13.10, 2.12 before 2.12.14 and 2.11 before 2.11.18.","evidence":"cve:CVE-2026-88804","products":[{"name":{"value":"Rancher","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-88804","aliases":["CVE-2026-88804"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":9.6,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/rancher/rancher/","vendor":"SUSE","product":"Rancher","versions":[{"status":"affected","version":"2.15.0","lessThan":"2.15.2","versionType":"semver"},{"status":"affected","version":"2.14.0","lessThan":"2.14.6","versionType":"semver"},{"status":"affected","version":"2.13.0","lessThan":"2.13.10","versionType":"semver"},{"status":"affected","version":"2.12.0","lessThan":"2.12.14","versionType":"semver"},{"status":"affected","version":"2.11.0se","lessThan":"2.11.18","versionType":"semver"}],"packageName":"Rancher","defaultStatus":"unaffected"}],"modified":"2026-09-28T18:02:56.882Z","provider":"cve","references":["https://github.com/rancher/rancher/security/advisories/GHSA-992f-xh8r-jg2f"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-88804","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-28T16:31:06.472253Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T18:02:56.882Z"}}],"cna":{"orgId":"404e59f5-483d-4b8a-8e7a-e67604dd8afb","shortName":"suse","dateUpdated":"2026-09-28T15:58:34.657Z"}}},"related_cves":[{"value":"CVE-2026-88804","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:fd9ce621-3a6a-46d7-aa1d-a86fc501f40e","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-88804","advisory_id":"fd9ce621-3a6a-46d7-aa1d-a86fc501f40e","event_types":["advisory"],"published_at":"2026-10-24T21:32:10.942851+00:00","technologies":["core-cve","rancher"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T15:58:34.657+00:00","detail_url":"/events/3287"}]}},{"id":3267,"cve_ids":["CVE-2026-93537"],"payload":{"kind":"advisory","title":"Path traversal in Fleet Helm valuesFiles allows disclosure of files outside the bundle directory","summary":"A user who can supply bundle content to a repository referenced by a GitRepo resource, for example through Git push access, or through permission to create or modify a GitRepo, can cause SUSE Rancher Fleet to read files from the filesystem of the environment that processes the bundle and include their contents in the generated Bundle resource. This can expose configuration or credential material that the user has no Kubernetes RBAC permission to read, including Helm registry credentials made available to the bundle-processing job when per-path Helm credentials are configured. This affects Fleet 0.16 before 0.16.2, 0.15 before 0.15.7, 0.14 before 0.14.11, 0.13 before 0.13.16, 0.12 before 0.12.20 and potentially older unsupported versions.","evidence":"cve:CVE-2026-93537","products":[{"name":{"value":"Rancher","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-93537","aliases":["CVE-2026-93537"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/rancher/fleet/","vendor":"SUSE","product":"Rancher","versions":[{"status":"affected","version":"0.16.0","lessThan":"0.16.2","versionType":"semver"},{"status":"affected","version":"0.15.0","lessThan":"0.15.7","versionType":"semver"},{"status":"affected","version":"0.14.0","lessThan":"0.14.11","versionType":"semver"},{"status":"affected","version":"0.13.0","lessThan":"0.13.16","versionType":"semver"},{"status":"affected","version":"0.12.0","lessThan":"0.12.20","versionType":"semver"}],"packageName":"Fleet","defaultStatus":"unaffected"}],"modified":"2026-09-28T17:54:22.754Z","provider":"cve","references":["https://github.com/rancher/fleet/security/advisories/GHSA-wpfm-r97v-3j4h"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-93537","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T17:54:00.943037Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T17:54:22.754Z"}}],"cna":{"orgId":"404e59f5-483d-4b8a-8e7a-e67604dd8afb","shortName":"suse","dateUpdated":"2026-09-28T13:29:10.263Z"}}},"related_cves":[{"value":"CVE-2026-93537","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:1fdac3f0-3a88-4cad-924c-747b4c3bb9dd","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93537","advisory_id":"1fdac3f0-3a88-4cad-924c-747b4c3bb9dd","event_types":["advisory"],"published_at":"2026-10-24T21:32:05.864412+00:00","technologies":["core-cve","rancher"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T13:29:10.263+00:00","detail_url":"/advisories/advisory%3A1fdac3f0-3a88-4cad-924c-747b4c3bb9dd","group":{"id":"advisory:1fdac3f0-3a88-4cad-924c-747b4c3bb9dd","revision":1,"primary_event_id":3279,"change":"published","superseded_by":[],"changed":{"id":3279,"cve_ids":["CVE-2026-93537"],"payload":{"kind":"advisory","title":"Path traversal in Fleet Helm valuesFiles allows disclosure of files outside the bundle directory","summary":"A user who can supply bundle content to a repository referenced by a GitRepo resource, for example through Git push access, or through permission to create or modify a GitRepo, can cause SUSE Rancher Fleet to read files from the filesystem of the environment that processes the bundle and include their contents in the generated Bundle resource. This can expose configuration or credential material that the user has no Kubernetes RBAC permission to read, including Helm registry credentials made available to the bundle-processing job when per-path Helm credentials are configured. This affects Fleet 0.16 before 0.16.2, 0.15 before 0.15.7, 0.14 before 0.14.11, 0.13 before 0.13.16, 0.12 before 0.12.20 and potentially older unsupported versions.","evidence":"cve:CVE-2026-93537","products":[{"name":{"value":"Rancher","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-93537","aliases":["CVE-2026-93537"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/rancher/fleet/","vendor":"SUSE","product":"Rancher","versions":[{"status":"affected","version":"0.16.0","lessThan":"0.16.2","versionType":"semver"},{"status":"affected","version":"0.15.0","lessThan":"0.15.7","versionType":"semver"},{"status":"affected","version":"0.14.0","lessThan":"0.14.11","versionType":"semver"},{"status":"affected","version":"0.13.0","lessThan":"0.13.16","versionType":"semver"},{"status":"affected","version":"0.12.0","lessThan":"0.12.20","versionType":"semver"}],"packageName":"Fleet","defaultStatus":"unaffected"}],"modified":"2026-09-28T17:54:22.754Z","provider":"cve","references":["https://github.com/rancher/fleet/security/advisories/GHSA-wpfm-r97v-3j4h"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-93537","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T17:54:00.943037Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T17:54:22.754Z"}}],"cna":{"orgId":"404e59f5-483d-4b8a-8e7a-e67604dd8afb","shortName":"suse","dateUpdated":"2026-09-28T13:29:10.263Z"}}},"related_cves":[{"value":"CVE-2026-93537","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:1fdac3f0-3a88-4cad-924c-747b4c3bb9dd","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93537","advisory_id":"1fdac3f0-3a88-4cad-924c-747b4c3bb9dd","event_types":["advisory"],"published_at":"2026-10-24T21:32:05.864412+00:00","technologies":["core-cve","rancher"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T13:29:10.263+00:00","detail_url":"/events/3279"},"members":[{"id":3279,"cve_ids":["CVE-2026-93537"],"payload":{"kind":"advisory","title":"Path traversal in Fleet Helm valuesFiles allows disclosure of files outside the bundle directory","summary":"A user who can supply bundle content to a repository referenced by a GitRepo resource, for example through Git push access, or through permission to create or modify a GitRepo, can cause SUSE Rancher Fleet to read files from the filesystem of the environment that processes the bundle and include their contents in the generated Bundle resource. This can expose configuration or credential material that the user has no Kubernetes RBAC permission to read, including Helm registry credentials made available to the bundle-processing job when per-path Helm credentials are configured. This affects Fleet 0.16 before 0.16.2, 0.15 before 0.15.7, 0.14 before 0.14.11, 0.13 before 0.13.16, 0.12 before 0.12.20 and potentially older unsupported versions.","evidence":"cve:CVE-2026-93537","products":[{"name":{"value":"Rancher","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-93537","aliases":["CVE-2026-93537"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/rancher/fleet/","vendor":"SUSE","product":"Rancher","versions":[{"status":"affected","version":"0.16.0","lessThan":"0.16.2","versionType":"semver"},{"status":"affected","version":"0.15.0","lessThan":"0.15.7","versionType":"semver"},{"status":"affected","version":"0.14.0","lessThan":"0.14.11","versionType":"semver"},{"status":"affected","version":"0.13.0","lessThan":"0.13.16","versionType":"semver"},{"status":"affected","version":"0.12.0","lessThan":"0.12.20","versionType":"semver"}],"packageName":"Fleet","defaultStatus":"unaffected"}],"modified":"2026-09-28T17:54:22.754Z","provider":"cve","references":["https://github.com/rancher/fleet/security/advisories/GHSA-wpfm-r97v-3j4h"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-93537","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T17:54:00.943037Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T17:54:22.754Z"}}],"cna":{"orgId":"404e59f5-483d-4b8a-8e7a-e67604dd8afb","shortName":"suse","dateUpdated":"2026-09-28T13:29:10.263Z"}}},"related_cves":[{"value":"CVE-2026-93537","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:1fdac3f0-3a88-4cad-924c-747b4c3bb9dd","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93537","advisory_id":"1fdac3f0-3a88-4cad-924c-747b4c3bb9dd","event_types":["advisory"],"published_at":"2026-10-24T21:32:05.864412+00:00","technologies":["core-cve","rancher"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T13:29:10.263+00:00","detail_url":"/events/3279"}]}},{"id":3180,"cve_ids":["CVE-2026-93540"],"payload":{"kind":"advisory","title":"Fleet applies namespace labels and annotations without the bundle's service account privileges","summary":"A privilege mismatch was found in Fleet. When a bundle requested namespace labels or annotations through the namespaceLabels and namespaceAnnotations options, the resulting namespace metadata update was not subject to the same authorization as the rest of the bundle's deployment. As a result, a bundle could change labels and annotations on a target namespace even when the identity it was pinned to was not authorized to modify that namespace. This affected SUSE Rancher Fleet 0.16 before 0.16.2, 0.15 before 0.15.7, 0.14 before 0.14.11, 0.13 before 0.13.16 and potentially older versions.","evidence":"cve:CVE-2026-93540","products":[{"name":{"value":"Rancher","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-93540","aliases":["CVE-2026-93540"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"NONE"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/rancher/fleet/","vendor":"SUSE","product":"Rancher","versions":[{"status":"affected","version":"0.16.0","lessThan":"0.16.1","versionType":"semver"},{"status":"affected","version":"0.15.0","lessThan":"0.15.7","versionType":"semver"},{"status":"affected","version":"0.14.0","lessThan":"0.14.11","versionType":"semver"},{"status":"affected","version":"0.13.0","lessThan":"0.13.16","versionType":"semver"}],"packageName":"Fleet","defaultStatus":"unaffected"}],"modified":"2026-09-28T16:22:25.780Z","provider":"cve","references":["https://github.com/rancher/fleet/security/advisories/GHSA-m93g-8438-2cgg"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-93540","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T15:25:53.294940Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T16:22:25.780Z"}}],"cna":{"orgId":"404e59f5-483d-4b8a-8e7a-e67604dd8afb","shortName":"suse","dateUpdated":"2026-09-28T14:45:42.336Z"}}},"related_cves":[{"value":"CVE-2026-93540","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:4369cd05-b2e0-4bbb-bc63-0d2740c44271","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93540","advisory_id":"4369cd05-b2e0-4bbb-bc63-0d2740c44271","event_types":["advisory"],"published_at":"2026-10-24T21:31:11.547343+00:00","technologies":["core-cve","rancher"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T14:45:42.336+00:00","detail_url":"/advisories/advisory%3A4369cd05-b2e0-4bbb-bc63-0d2740c44271","group":{"id":"advisory:4369cd05-b2e0-4bbb-bc63-0d2740c44271","revision":1,"primary_event_id":3191,"change":"published","superseded_by":[],"changed":{"id":3191,"cve_ids":["CVE-2026-93540"],"payload":{"kind":"advisory","title":"Fleet applies namespace labels and annotations without the bundle's service account privileges","summary":"A privilege mismatch was found in Fleet. When a bundle requested namespace labels or annotations through the namespaceLabels and namespaceAnnotations options, the resulting namespace metadata update was not subject to the same authorization as the rest of the bundle's deployment. As a result, a bundle could change labels and annotations on a target namespace even when the identity it was pinned to was not authorized to modify that namespace. This affected SUSE Rancher Fleet 0.16 before 0.16.2, 0.15 before 0.15.7, 0.14 before 0.14.11, 0.13 before 0.13.16 and potentially older versions.","evidence":"cve:CVE-2026-93540","products":[{"name":{"value":"Rancher","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-93540","aliases":["CVE-2026-93540"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"NONE"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/rancher/fleet/","vendor":"SUSE","product":"Rancher","versions":[{"status":"affected","version":"0.16.0","lessThan":"0.16.1","versionType":"semver"},{"status":"affected","version":"0.15.0","lessThan":"0.15.7","versionType":"semver"},{"status":"affected","version":"0.14.0","lessThan":"0.14.11","versionType":"semver"},{"status":"affected","version":"0.13.0","lessThan":"0.13.16","versionType":"semver"}],"packageName":"Fleet","defaultStatus":"unaffected"}],"modified":"2026-09-28T16:22:25.780Z","provider":"cve","references":["https://github.com/rancher/fleet/security/advisories/GHSA-m93g-8438-2cgg"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-93540","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T15:25:53.294940Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T16:22:25.780Z"}}],"cna":{"orgId":"404e59f5-483d-4b8a-8e7a-e67604dd8afb","shortName":"suse","dateUpdated":"2026-09-28T14:45:42.336Z"}}},"related_cves":[{"value":"CVE-2026-93540","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:4369cd05-b2e0-4bbb-bc63-0d2740c44271","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93540","advisory_id":"4369cd05-b2e0-4bbb-bc63-0d2740c44271","event_types":["advisory"],"published_at":"2026-10-24T21:31:11.547343+00:00","technologies":["core-cve","rancher"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T14:45:42.336+00:00","detail_url":"/events/3191"},"members":[{"id":3191,"cve_ids":["CVE-2026-93540"],"payload":{"kind":"advisory","title":"Fleet applies namespace labels and annotations without the bundle's service account privileges","summary":"A privilege mismatch was found in Fleet. When a bundle requested namespace labels or annotations through the namespaceLabels and namespaceAnnotations options, the resulting namespace metadata update was not subject to the same authorization as the rest of the bundle's deployment. As a result, a bundle could change labels and annotations on a target namespace even when the identity it was pinned to was not authorized to modify that namespace. This affected SUSE Rancher Fleet 0.16 before 0.16.2, 0.15 before 0.15.7, 0.14 before 0.14.11, 0.13 before 0.13.16 and potentially older versions.","evidence":"cve:CVE-2026-93540","products":[{"name":{"value":"Rancher","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-93540","aliases":["CVE-2026-93540"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"NONE"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/rancher/fleet/","vendor":"SUSE","product":"Rancher","versions":[{"status":"affected","version":"0.16.0","lessThan":"0.16.1","versionType":"semver"},{"status":"affected","version":"0.15.0","lessThan":"0.15.7","versionType":"semver"},{"status":"affected","version":"0.14.0","lessThan":"0.14.11","versionType":"semver"},{"status":"affected","version":"0.13.0","lessThan":"0.13.16","versionType":"semver"}],"packageName":"Fleet","defaultStatus":"unaffected"}],"modified":"2026-09-28T16:22:25.780Z","provider":"cve","references":["https://github.com/rancher/fleet/security/advisories/GHSA-m93g-8438-2cgg"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-93540","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T15:25:53.294940Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T16:22:25.780Z"}}],"cna":{"orgId":"404e59f5-483d-4b8a-8e7a-e67604dd8afb","shortName":"suse","dateUpdated":"2026-09-28T14:45:42.336Z"}}},"related_cves":[{"value":"CVE-2026-93540","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:4369cd05-b2e0-4bbb-bc63-0d2740c44271","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93540","advisory_id":"4369cd05-b2e0-4bbb-bc63-0d2740c44271","event_types":["advisory"],"published_at":"2026-10-24T21:31:11.547343+00:00","technologies":["core-cve","rancher"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T14:45:42.336+00:00","detail_url":"/events/3191"}]}},{"id":3179,"cve_ids":["CVE-2026-93538"],"payload":{"kind":"advisory","title":"Cross-tenant BundleDeployment and Secret disclosure via spoofed cluster labels during agent-initiated registration in Fleet","summary":"A cross-tenant authorization issue was discovered in SUSE Rancher Fleet. During agent-initiated cluster registration, cluster labels supplied by the registering agent, including labels in the reserved management.cattle.io/ namespace such as the cluster display name label, were applied to the resulting upstream Cluster object. Because Fleet resolves GitRepo and Bundle targets from those cluster labels, a party able to register a cluster into a Fleet workspace namespace shared with other tenants could cause its own cluster to satisfy targeting rules that administrators intended for a different cluster. This affects SUSE Rancher Fleet 0.16 before 0.16.1, 0.15 before 0.15.6, 0.14 before 0.14.10, 0.13 before 0.13.15, 0.12 before 0.12.19 and older versions.","evidence":"cve:CVE-2026-93538","products":[{"name":{"value":"Rancher","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-93538","aliases":["CVE-2026-93538"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/rancher/fleet/","vendor":"SUSE","product":"Rancher","versions":[{"status":"affected","version":"0.16.0","lessThan":"0.16.1","versionType":"semver"},{"status":"affected","version":"0.15.0","lessThan":"0.15.6","versionType":"semver"},{"status":"affected","version":"0.14.0","lessThan":"0.14.10","versionType":"semver"},{"status":"affected","version":"0.13.0","lessThan":"0.13.15","versionType":"semver"},{"status":"affected","version":"0.12.0","lessThan":"0.12.19","versionType":"semver"}],"packageName":"Fleet","defaultStatus":"unaffected"}],"modified":"2026-09-28T16:22:26.562Z","provider":"cve","references":["https://github.com/rancher/fleet/security/advisories/GHSA-h9p5-fp5h-qpqr"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-93538","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T15:46:41.479078Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T16:22:26.562Z"}}],"cna":{"orgId":"404e59f5-483d-4b8a-8e7a-e67604dd8afb","shortName":"suse","dateUpdated":"2026-09-28T14:10:21.720Z"}}},"related_cves":[{"value":"CVE-2026-93538","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:de9c67b0-3db6-4260-a5fa-b5c0b49bfefe","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93538","advisory_id":"de9c67b0-3db6-4260-a5fa-b5c0b49bfefe","event_types":["advisory"],"published_at":"2026-10-24T21:31:10.940664+00:00","technologies":["core-cve","rancher"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T14:10:21.72+00:00","detail_url":"/advisories/advisory%3Ade9c67b0-3db6-4260-a5fa-b5c0b49bfefe","group":{"id":"advisory:de9c67b0-3db6-4260-a5fa-b5c0b49bfefe","revision":1,"primary_event_id":3190,"change":"published","superseded_by":[],"changed":{"id":3190,"cve_ids":["CVE-2026-93538"],"payload":{"kind":"advisory","title":"Cross-tenant BundleDeployment and Secret disclosure via spoofed cluster labels during agent-initiated registration in Fleet","summary":"A cross-tenant authorization issue was discovered in SUSE Rancher Fleet. During agent-initiated cluster registration, cluster labels supplied by the registering agent, including labels in the reserved management.cattle.io/ namespace such as the cluster display name label, were applied to the resulting upstream Cluster object. Because Fleet resolves GitRepo and Bundle targets from those cluster labels, a party able to register a cluster into a Fleet workspace namespace shared with other tenants could cause its own cluster to satisfy targeting rules that administrators intended for a different cluster. This affects SUSE Rancher Fleet 0.16 before 0.16.1, 0.15 before 0.15.6, 0.14 before 0.14.10, 0.13 before 0.13.15, 0.12 before 0.12.19 and older versions.","evidence":"cve:CVE-2026-93538","products":[{"name":{"value":"Rancher","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-93538","aliases":["CVE-2026-93538"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/rancher/fleet/","vendor":"SUSE","product":"Rancher","versions":[{"status":"affected","version":"0.16.0","lessThan":"0.16.1","versionType":"semver"},{"status":"affected","version":"0.15.0","lessThan":"0.15.6","versionType":"semver"},{"status":"affected","version":"0.14.0","lessThan":"0.14.10","versionType":"semver"},{"status":"affected","version":"0.13.0","lessThan":"0.13.15","versionType":"semver"},{"status":"affected","version":"0.12.0","lessThan":"0.12.19","versionType":"semver"}],"packageName":"Fleet","defaultStatus":"unaffected"}],"modified":"2026-09-28T16:22:26.562Z","provider":"cve","references":["https://github.com/rancher/fleet/security/advisories/GHSA-h9p5-fp5h-qpqr"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-93538","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T15:46:41.479078Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T16:22:26.562Z"}}],"cna":{"orgId":"404e59f5-483d-4b8a-8e7a-e67604dd8afb","shortName":"suse","dateUpdated":"2026-09-28T14:10:21.720Z"}}},"related_cves":[{"value":"CVE-2026-93538","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:de9c67b0-3db6-4260-a5fa-b5c0b49bfefe","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93538","advisory_id":"de9c67b0-3db6-4260-a5fa-b5c0b49bfefe","event_types":["advisory"],"published_at":"2026-10-24T21:31:10.940664+00:00","technologies":["core-cve","rancher"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T14:10:21.72+00:00","detail_url":"/events/3190"},"members":[{"id":3190,"cve_ids":["CVE-2026-93538"],"payload":{"kind":"advisory","title":"Cross-tenant BundleDeployment and Secret disclosure via spoofed cluster labels during agent-initiated registration in Fleet","summary":"A cross-tenant authorization issue was discovered in SUSE Rancher Fleet. During agent-initiated cluster registration, cluster labels supplied by the registering agent, including labels in the reserved management.cattle.io/ namespace such as the cluster display name label, were applied to the resulting upstream Cluster object. Because Fleet resolves GitRepo and Bundle targets from those cluster labels, a party able to register a cluster into a Fleet workspace namespace shared with other tenants could cause its own cluster to satisfy targeting rules that administrators intended for a different cluster. This affects SUSE Rancher Fleet 0.16 before 0.16.1, 0.15 before 0.15.6, 0.14 before 0.14.10, 0.13 before 0.13.15, 0.12 before 0.12.19 and older versions.","evidence":"cve:CVE-2026-93538","products":[{"name":{"value":"Rancher","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-93538","aliases":["CVE-2026-93538"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/rancher/fleet/","vendor":"SUSE","product":"Rancher","versions":[{"status":"affected","version":"0.16.0","lessThan":"0.16.1","versionType":"semver"},{"status":"affected","version":"0.15.0","lessThan":"0.15.6","versionType":"semver"},{"status":"affected","version":"0.14.0","lessThan":"0.14.10","versionType":"semver"},{"status":"affected","version":"0.13.0","lessThan":"0.13.15","versionType":"semver"},{"status":"affected","version":"0.12.0","lessThan":"0.12.19","versionType":"semver"}],"packageName":"Fleet","defaultStatus":"unaffected"}],"modified":"2026-09-28T16:22:26.562Z","provider":"cve","references":["https://github.com/rancher/fleet/security/advisories/GHSA-h9p5-fp5h-qpqr"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-93538","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T15:46:41.479078Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T16:22:26.562Z"}}],"cna":{"orgId":"404e59f5-483d-4b8a-8e7a-e67604dd8afb","shortName":"suse","dateUpdated":"2026-09-28T14:10:21.720Z"}}},"related_cves":[{"value":"CVE-2026-93538","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:de9c67b0-3db6-4260-a5fa-b5c0b49bfefe","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93538","advisory_id":"de9c67b0-3db6-4260-a5fa-b5c0b49bfefe","event_types":["advisory"],"published_at":"2026-10-24T21:31:10.940664+00:00","technologies":["core-cve","rancher"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T14:10:21.72+00:00","detail_url":"/events/3190"}]}},{"id":3177,"cve_ids":["CVE-2026-93539"],"payload":{"kind":"advisory","title":"Unauthenticated GitRepo Spec Mutation via Fleet Git Webhook Receiver","summary":"A vulnerability was discovered in Fleet's Git webhook receiver (the gitjob webhook service). When a webhook secret is not configured, incoming webhook requests are accepted without verification, and processing a request can change the spec.pollingInterval field of a matching GitRepo resource in any namespace. A caller with network access to the webhook service and no Kubernetes credentials can therefore alter GitRepo configuration outside the namespaces they are authorized for. This only affects SUSE Rancher Fleet 0.16 before 0.16.2, older versions are not affected.","evidence":"cve:CVE-2026-93539","products":[{"name":{"value":"Rancher","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-93539","aliases":["CVE-2026-93539"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.4,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"LOW","confidentialityImpact":"NONE"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/rancher/fleet/","vendor":"SUSE","product":"Rancher","versions":[{"status":"affected","version":"0.16.0","lessThan":"0.16.2","versionType":"semver"}],"packageName":"Fleet","defaultStatus":"unaffected"}],"modified":"2026-09-28T16:22:26.433Z","provider":"cve","references":["https://github.com/rancher/fleet/security/advisories/GHSA-8vfv-33cg-g75q"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-93539","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T14:59:38.674475Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T16:22:26.433Z"}}],"cna":{"orgId":"404e59f5-483d-4b8a-8e7a-e67604dd8afb","shortName":"suse","dateUpdated":"2026-09-28T14:19:55.071Z"}}},"related_cves":[{"value":"CVE-2026-93539","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:51eb8154-0995-4993-88fb-38b61d132b25","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93539","advisory_id":"51eb8154-0995-4993-88fb-38b61d132b25","event_types":["advisory"],"published_at":"2026-10-24T21:31:09.794208+00:00","technologies":["core-cve","rancher"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T14:19:55.071+00:00","detail_url":"/advisories/advisory%3A51eb8154-0995-4993-88fb-38b61d132b25","group":{"id":"advisory:51eb8154-0995-4993-88fb-38b61d132b25","revision":1,"primary_event_id":3188,"change":"published","superseded_by":[],"changed":{"id":3188,"cve_ids":["CVE-2026-93539"],"payload":{"kind":"advisory","title":"Unauthenticated GitRepo Spec Mutation via Fleet Git Webhook Receiver","summary":"A vulnerability was discovered in Fleet's Git webhook receiver (the gitjob webhook service). When a webhook secret is not configured, incoming webhook requests are accepted without verification, and processing a request can change the spec.pollingInterval field of a matching GitRepo resource in any namespace. A caller with network access to the webhook service and no Kubernetes credentials can therefore alter GitRepo configuration outside the namespaces they are authorized for. This only affects SUSE Rancher Fleet 0.16 before 0.16.2, older versions are not affected.","evidence":"cve:CVE-2026-93539","products":[{"name":{"value":"Rancher","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-93539","aliases":["CVE-2026-93539"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.4,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"LOW","confidentialityImpact":"NONE"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/rancher/fleet/","vendor":"SUSE","product":"Rancher","versions":[{"status":"affected","version":"0.16.0","lessThan":"0.16.2","versionType":"semver"}],"packageName":"Fleet","defaultStatus":"unaffected"}],"modified":"2026-09-28T16:22:26.433Z","provider":"cve","references":["https://github.com/rancher/fleet/security/advisories/GHSA-8vfv-33cg-g75q"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-93539","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T14:59:38.674475Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T16:22:26.433Z"}}],"cna":{"orgId":"404e59f5-483d-4b8a-8e7a-e67604dd8afb","shortName":"suse","dateUpdated":"2026-09-28T14:19:55.071Z"}}},"related_cves":[{"value":"CVE-2026-93539","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:51eb8154-0995-4993-88fb-38b61d132b25","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93539","advisory_id":"51eb8154-0995-4993-88fb-38b61d132b25","event_types":["advisory"],"published_at":"2026-10-24T21:31:09.794208+00:00","technologies":["core-cve","rancher"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T14:19:55.071+00:00","detail_url":"/events/3188"},"members":[{"id":3188,"cve_ids":["CVE-2026-93539"],"payload":{"kind":"advisory","title":"Unauthenticated GitRepo Spec Mutation via Fleet Git Webhook Receiver","summary":"A vulnerability was discovered in Fleet's Git webhook receiver (the gitjob webhook service). When a webhook secret is not configured, incoming webhook requests are accepted without verification, and processing a request can change the spec.pollingInterval field of a matching GitRepo resource in any namespace. A caller with network access to the webhook service and no Kubernetes credentials can therefore alter GitRepo configuration outside the namespaces they are authorized for. This only affects SUSE Rancher Fleet 0.16 before 0.16.2, older versions are not affected.","evidence":"cve:CVE-2026-93539","products":[{"name":{"value":"Rancher","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-93539","aliases":["CVE-2026-93539"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.4,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"LOW","confidentialityImpact":"NONE"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/rancher/fleet/","vendor":"SUSE","product":"Rancher","versions":[{"status":"affected","version":"0.16.0","lessThan":"0.16.2","versionType":"semver"}],"packageName":"Fleet","defaultStatus":"unaffected"}],"modified":"2026-09-28T16:22:26.433Z","provider":"cve","references":["https://github.com/rancher/fleet/security/advisories/GHSA-8vfv-33cg-g75q"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-93539","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T14:59:38.674475Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T16:22:26.433Z"}}],"cna":{"orgId":"404e59f5-483d-4b8a-8e7a-e67604dd8afb","shortName":"suse","dateUpdated":"2026-09-28T14:19:55.071Z"}}},"related_cves":[{"value":"CVE-2026-93539","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:51eb8154-0995-4993-88fb-38b61d132b25","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93539","advisory_id":"51eb8154-0995-4993-88fb-38b61d132b25","event_types":["advisory"],"published_at":"2026-10-24T21:31:09.794208+00:00","technologies":["core-cve","rancher"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T14:19:55.071+00:00","detail_url":"/events/3188"}]}}],"next_after":32573,"next_before":3177}