CVE-2026-93537

Name of the Vulnerable Software and Affected Versions SUSE Rancher Fleet versions prior to 0.16.2 SUSE Rancher Fleet versions prior to 0.15.7 SUSE Rancher Fleet versions prior to 0.14.11 SUSE Rancher Fleet versions prior to 0.13.16 SUSE Rancher Fleet versions prior to 0.12.20

Description A user with the ability to provide bundle content to a repository referenced by a GitRepo resource, such as through Git push access or permissions to create or modify a GitRepo, can force the system to read files from the filesystem of the bundle-processing environment. These files are then included in the generated Bundle resource, potentially exposing configuration data or credentials that the user is not authorized to access via Kubernetes RBAC (Role-Based Access Control), including Helm registry credentials used when per-path Helm credentials are configured.

Recommendations Update to version 0.16.2 or later. Update to version 0.15.7 or later. Update to version 0.14.11 or later. Update to version 0.13.16 or later. Update to version 0.12.20 or later.