CVE-2026-94290

Name of the Vulnerable Software and Affected Versions SUSE Rancher Fleet versions 0.13.0 through 0.13.17 SUSE Rancher Fleet versions 0.14.0 through 0.14.12 SUSE Rancher Fleet versions 0.15.0 through 0.15.8 SUSE Rancher Fleet versions 0.16.0 through 0.16.3 SUSE Rancher versions prior to 2.13.11 SUSE Rancher versions prior to 2.14.7 SUSE Rancher versions prior to 2.15.3

Description SUSE Rancher Fleet clusters use a kubeconfig secret for the controller to install and manage a Fleet agent on target clusters. The controller fails to sufficiently restrict which kubeconfig secrets a Fleet Cluster object can reference. This allows a user with control over a namespace to associate a Fleet cluster with administrative credentials of the management cluster, enabling the controller to execute the user's Fleet content on the management cluster with elevated privileges.

Recommendations Update SUSE Rancher Fleet versions 0.13.0 through 0.13.17 to a version newer than 0.13.17. Update SUSE Rancher Fleet versions 0.14.0 through 0.14.12 to a version newer than 0.14.12. Update SUSE Rancher Fleet versions 0.15.0 through 0.15.8 to a version newer than 0.15.8. Update SUSE Rancher Fleet versions 0.16.0 through 0.16.3 to a version newer than 0.16.3. Update SUSE Rancher to version 2.13.11. Update SUSE Rancher to version 2.14.7. Update SUSE Rancher to version 2.15.3.