Kritik CVSS 9.9
CVE-2026-41050: Rancher Fleet: hatalı yetkilendirme
Açıklama (NVD)
Fleet's Helm deployer did not fully apply ServiceAccount impersonation in two code paths, allowing a tenant with git push access to a Fleet-monitored repository to read secrets from any namespace on every downstream cluster targeted by their `GitRepo`.
Özet bilgiler
- Ürün
- Suse Rancher Fleet
- CVSS v3.1
- 9.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - EPSS
- %0,39 (yüzdelik 33)
- CWE
- CWE-863
- Yama
- Yok / bilinmiyor
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| suse-rancher-fleet | 0.11.0 | — | 0.11.13 |
| suse-rancher-fleet | 0.12.0 | — | 0.12.14 |
| suse-rancher-fleet | 0.13.0 | — | 0.13.10 |
| suse-rancher-fleet | 0.14.0 | — | 0.14.5 |
| suse-rancher-fleet | 0.15.0 | — | 0.15.1 |