PT-2026-99905

CVE-2026-93539

Published

2026-09-28

Updated

2026-09-28

Description by

CVSS 3.1

5.4

Medium

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions SUSE Rancher Fleet versions 0.16 through 0.16.1

Description The Git webhook receiver (the gitjob webhook service) fails to verify incoming requests when a webhook secret is not configured. This allows a remote caller with network access to the service, even without Kubernetes credentials, to modify the spec.pollingInterval field of a matching GitRepo resource across any namespace, enabling unauthorized configuration changes.

Recommendations Update SUSE Rancher Fleet to version 0.16.2.

Exploitability

Exploit

Fix

Impacts

Researchers

Pig-Tail

Vendors

Affected products

Weakness enumeration

CWE-306: Missing Authentication for Critical Function

Related identifiers