← Vulnerability feed

Vulnerability record · CVE-2026-75036 · published 3 September 2026

CVE-2026-75036: Suse rancher fleet server-side request forgery (ssrf) vulnerability

Suse · Rancher Fleet

A security vulnerability was discovered in Fleet's Helm template preprocessing where templates evaluated by the Fleet controller could reach network resources outside the management cluster. A user who can supply bundle content to a repository referenced by a `GitRepo` resource can cause the Fleet controller to: - Disclose cluster metadata available to the templating context. - Reveal information about hosts reachable from the controller's network position. Because the disclosure channel is name resolution, it may remain effective in environments where outbound traffic is otherwise restricted. The disclosed information is limited to values exposed to the Fleet templating context and to name resolution results. Integrity and availability of managed clusters are not affected. This issue affects Fleet: from 0.12.0 before 0.12.19, from 0.13.0 before 0.13.15, from 0.14.0 before 0.14.10, from 0.15.0 before 0.15.6, and from 0.16.0 before 0.16.1.

5.3 CVSS 4.0 Medium EPSS 0.16% · top 95.2% CWE-918 · Server-side request forgery (SSRF)CWE-1336 · CWE-1336
5.3CVSS 4.0 base score
0.16%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
1References
7 Oct 2026Last modified by NVD

Description

A security vulnerability was discovered in Fleet's Helm template preprocessing where templates evaluated by the Fleet controller could reach network resources outside the management cluster. A user who can supply bundle content to a repository referenced by a `GitRepo` resource can cause the Fleet controller to: - Disclose cluster metadata available to the templating context. - Reveal information about hosts reachable from the controller's network position. Because the disclosure channel is name resolution, it may remain effective in environments where outbound traffic is otherwise restricted. The disclosed information is limited to values exposed to the Fleet templating context and to name resolution results. Integrity and availability of managed clusters are not affected. This issue affects Fleet: from 0.12.0 before 0.12.19, from 0.13.0 before 0.13.15, from 0.14.0 before 0.14.10, from 0.15.0 before 0.15.6, and from 0.16.0 before 0.16.1.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/rancher/fleet/security/advisories/GHSA-x9m6-xcjr-hpjp Vendor Advisory

Track CVE-2026-75036 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.9CVE-2026-44935Suse rancher fleet vulnerabilityMissing validation of "valuesFrom" references in Helm Deployer of SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and …EPSS 0.49%8.8CVE-2026-88808Suse rancher fleet execution with unnecessary privileges vulnerabilityA vulnerability has been identified within Rancher Manager where the Fleet agent wrote resources to downstream clusters using its own cluster-admin c…EPSS 0.28%8.3CVE-2026-44937Suse rancher fleet server-side request forgery (ssrf) vulnerabilityPotential forgery of webhook requests when using a unauthenticated webhook in SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before …EPSS 0.42%7.1CVE-2026-93538Suse rancher fleet authentication bypass by spoofing vulnerabilityA cross-tenant authorization issue was discovered in SUSE Rancher Fleet. During agent-initiated cluster registration, cluster labels supplied by the …EPSS 0.17%6.5CVE-2026-93540Suse rancher fleet vulnerabilityA privilege mismatch was found in Fleet. When a bundle requested namespace labels or annotations through the namespaceLabels and namespaceAnnotations…EPSS 0.17%6.5CVE-2026-93537Suse rancher fleet relative path traversal vulnerabilityA user who can supply bundle content to a repository referenced by a GitRepo resource, for example through Git push access, or through permission to …EPSS 0.31%5.4CVE-2026-93539Suse rancher fleet missing authentication for critical function vulnerabilityA vulnerability was discovered in Fleet's Git webhook receiver (the gitjob webhook service). When a webhook secret is not configured, incoming webhoo…EPSS 0.23%5.0CVE-2026-44936Suse rancher fleet server-side request forgery (ssrf) vulnerabilityMissing filtering when the helmRepoURLRegex field isn't set on a GitRepo resource in SUSE Rancher Fleet's bundle reader in 0.15 before 0.15.2, 0.14 b…EPSS 0.35%

Source: NIST National Vulnerability Database (record CVE-2026-75036), CISA KEV, FIRST EPSS (scores of 2026-10-10). This page is refreshed as NVD updates the record.