CVE-2026-44935

critical · 9.9

Missing validation of "valuesFrom" references in Helm Deployer of SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.15 could be used by owners of one tenant to access fleet credentials of other tenants.

9.9

CVSS

0.5%

EPSS (exploit prob.)

41st

EPSS percentile

2026-07-02

Published

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weaknesses

CWE-1287

Affected products

Vendor	Product	Affected versions
suse	rancher_fleet	>= 0.12.0, < 0.12.15
suse	rancher_fleet	>= 0.13.0, < 0.13.11
suse	rancher_fleet	>= 0.14.0, < 0.14.6
suse	rancher_fleet	>= 0.15.0, < 0.15.2

Check a specific version with /api/v1/cve/match.

References

https://github.com/rancher/fleet/security/advisories/GHSA-xr65-5cpm-g36x

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-44935