G.Mygenie@Gmail.Com

**Name of the Vulnerable Software and Affected Versions** SUSE Rancher Fleet versions prior to 0.16.2 SUSE Rancher Fleet versions prior to 0.15.7 SUSE Rancher Fleet versions prior to 0.14.11 SUSE Rancher Fleet versions prior to 0.13.16 **Description** A privilege mismatch exists where updates to namespace metadata are not subject to the same authorization checks as the rest of a bundle's deployment. This occurs when a bundle requests namespace labels or annotations using the `namespaceLabels` and `namespaceAnnotations` options, allowing a bundle to modify labels and annotations on a target namespace even if the pinned identity lacks the necessary authorization to modify that namespace. **Recommendations** Update to version 0.16.2 or later. Update to version 0.15.7 or later. Update to version 0.14.11 or later. Update to version 0.13.16 or later.

**Name of the Vulnerable Software and Affected Versions** SUSE Rancher Fleet versions 0.16 through 0.16.1 SUSE Rancher Fleet versions 0.15 through 0.15.6 SUSE Rancher Fleet versions 0.14 through 0.14.10 **Description** An issue exists in Rancher Manager where the Fleet agent utilizes its own cluster-admin credentials to write resources to downstream clusters instead of using the ServiceAccount pinned to the deployment. In multi-tenancy environments where different tenants, such as privileged or untrusted teams within the same organization, share the same downstream clusters, this could result in the overwriting of configuration files. **Recommendations** Update SUSE Rancher Fleet version 0.16 to 0.16.2. Update SUSE Rancher Fleet version 0.15 to 0.15.7. Update SUSE Rancher Fleet version 0.14 to 0.14.11.