CVE-2026-88808

Name of the Vulnerable Software and Affected Versions SUSE Rancher Fleet versions 0.16 through 0.16.1 SUSE Rancher Fleet versions 0.15 through 0.15.6 SUSE Rancher Fleet versions 0.14 through 0.14.10

Description An issue exists in Rancher Manager where the Fleet agent utilizes its own cluster-admin credentials to write resources to downstream clusters instead of using the ServiceAccount pinned to the deployment. In multi-tenancy environments where different tenants, such as privileged or untrusted teams within the same organization, share the same downstream clusters, this could result in the overwriting of configuration files.

Recommendations Update SUSE Rancher Fleet version 0.16 to 0.16.2. Update SUSE Rancher Fleet version 0.15 to 0.15.7. Update SUSE Rancher Fleet version 0.14 to 0.14.11.