CVE-2026-104615

Name of the Vulnerable Software and Affected Versions SUSE Rancher Fleet versions prior to 0.12 SUSE Rancher Fleet versions 0.13.0 through 0.13.17 SUSE Rancher Fleet versions 0.14.0 through 0.14.12 SUSE Rancher Fleet versions 0.15.0 through 0.15.17 SUSE Rancher Fleet versions 0.16.0 through 0.16.3

Description An issue exists in the cluster registration flow where the cluster identity claimed by a registration request is accepted without being bound to the registration token used for the request. This allows a registration request to be associated with a managed cluster that was originally registered using a different registration token.

Recommendations Update SUSE Rancher Fleet to version 0.12 or later. Update SUSE Rancher Fleet to version 0.13.18 or later. Update SUSE Rancher Fleet to version 0.14.13 or later. Update SUSE Rancher Fleet to version 0.15.18 or later. Update SUSE Rancher Fleet to version 0.16.4 or later.