Radisauskas Arnoldas

**Name of the Vulnerable Software and Affected Versions** Fleet versions prior to 0.12.15 Fleet versions prior to 0.13.11 Fleet versions prior to 0.14.6 Fleet versions prior to 0.15.2 **Description** Fleet forwards Helm authentication credentials (`BasicAuth`) to any URL specified in the `helm.repo` field of a `fleet.yaml` file when the `helmRepoURLRegex` field is not set on a `GitRepo` resource. An attacker with git push access to a monitored repository can specify a malicious URL in `helm.repo`, causing the Fleet controller to send the configured Helm repository username and password to the attacker's server. **Recommendations** Upgrade to Fleet versions 0.12.15, 0.13.11, 0.14.6, or 0.15.2. As a temporary workaround, set the `helmRepoURLRegex` on all `GitRepo` resources that use `helmSecretName` to ensure the regular expression matches only legitimate Helm repository URLs. Review the system for potentially leaked credentials and replace any compromised credentials.

**Name of the Vulnerable Software and Affected Versions** Rancher Fleet (affected versions not specified) **Description** An authentication bypass exists in the webhook component. Additionally, a Pod Security Standard (PSS) bypass can be achieved through the manipulation of namespace labels. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SUSE Rancher Fleet versions prior to 0.15.2 SUSE Rancher Fleet versions prior to 0.14.6 SUSE Rancher Fleet versions prior to 0.13.11 SUSE Rancher Fleet versions prior to 0.12.15 **Description** Missing validation of `valuesFrom` references in the Helm Deployer allows tenants in multi-tenancy environments to bypass restrictions and access config maps or secrets across all namespaces on downstream clusters. An attacker can use `valuesFrom` within a `fleet.yaml` (via a `GitRepo` resource) or a `HelmOp` resource to read secret contents if the name, namespace, and key are known or guessed. Additionally, unauthorized users can create cluster-wide resources using `HelmOp` or `Bundle` without being restricted to a specific service account for the Fleet agent. **Recommendations** Upgrade SUSE Rancher Fleet to version 0.15.2 or later. Upgrade SUSE Rancher Fleet to version 0.14.6 or later. Upgrade SUSE Rancher Fleet to version 0.13.11 or later. Upgrade SUSE Rancher Fleet to version 0.12.15 or later. As a temporary workaround, ensure that tenants do not have shared access to the same downstream clusters.

**Name of the Vulnerable Software and Affected Versions** Fleet versions prior to 0.15.2 Fleet versions prior to 0.14.6 Fleet versions prior to 0.13.11 Fleet versions prior to 0.12.15 **Description** An issue exists when the webhook endpoint is configured without a secret, allowing unauthenticated attackers to forge webhook requests. The root cause is improper authentication and validation of requests combined with regex-based injection via unescaped repository URL and path components. An attacker can send crafted payloads to the webhook endpoint without needing to know the specific repository or path configured in the GitRepo resource. This can lead to continuous repository re-cloning, resulting in network traffic increases and resource exhaustion on the management cluster, causing a denial of service. Additionally, if the attacker has read access to the target Git repository and knows its path, they can downgrade running services to any historical revision available in the remote repository. **Recommendations** Upgrade to version 0.15.2. Upgrade to version 0.14.6. Upgrade to version 0.13.11. Upgrade to version 0.12.15. As a temporary workaround, ensure that webhooks are only enabled when configured with a shared secret.

**Name of the Vulnerable Software and Affected Versions** Rancher Manager versions prior to 2.14.2 **Description** A command injection issue exists in the import endpoint "/v3/import/{token} {clusterId}.yaml". This occurs due to unsanitized YAML parameters, which could allow remote attackers to break out of an image and execute malicious containers. **Recommendations** Update to version 2.14.2 or later.

**Name of the Vulnerable Software and Affected Versions** PlexTrac versions 1.61.3 through 2.8.1 **Description** The issue is related to the improper neutralization of special elements used in an N1QL command, allowing N1QL Injection. This problem can be exploited due to the lack of proper handling of special elements in N1QL commands. **Recommendations** For PlexTrac versions 1.61.3 through 2.8.1, update to a version 2.8.1 or later to resolve the issue. As a temporary workaround, consider restricting access to N1QL commands to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** PlexTrac versions 1.61.3 through 2.8.1 **Description** The issue is related to Uncontrolled Resource Consumption in PlexTrac, which allows a WebSocket Denial of Service (DoS) attack. This can cause a resource drain. **Recommendations** For PlexTrac versions 1.61.3 through 2.8.1, update to version 2.8.1 or later to resolve the issue. As a temporary workaround, consider restricting access to WebSocket functionality to minimize the risk of exploitation.