← Vulnerability feed

Vulnerability record · CVE-2026-44935 · published 2 July 2026

CVE-2026-44935: Suse rancher fleet vulnerability

Suse · Rancher Fleet

Missing validation of "valuesFrom" references in Helm Deployer of SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.15 could be used by owners of one tenant to access fleet credentials of other tenants.

9.9 CVSS 3.1 Critical EPSS 0.49% · top 60.3% CWE-1287 · CWE-1287
9.9CVSS 3.1 base score
0.49%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
1References
6 Jul 2026Last modified by NVD

Description

Missing validation of "valuesFrom" references in Helm Deployer of SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.15 could be used by owners of one tenant to access fleet credentials of other tenants.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/rancher/fleet/security/advisories/GHSA-xr65-5cpm-g36x Vendor Advisory

Track CVE-2026-44935 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.3CVE-2026-44937Suse rancher fleet server-side request forgery (ssrf) vulnerabilityPotential forgery of webhook requests when using a unauthenticated webhook in SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before …EPSS 0.42%5.0CVE-2026-44936Suse rancher fleet server-side request forgery (ssrf) vulnerabilityMissing filtering when the helmRepoURLRegex field isn't set on a GitRepo resource in SUSE Rancher Fleet's bundle reader in 0.15 before 0.15.2, 0.14 b…EPSS 0.35%9.3CVE-2024-4879ServiceNow Now Platform input validation flaw allows unauthenticated RCEServiceNow's Now Platform (Vancouver and Washington DC releases) contains an input validation vulnerability that lets an unauthenticated remote attac…KEVEPSS 100%analysed

Source: NIST National Vulnerability Database (record CVE-2026-44935), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.