Vulnerability in SUSE Rancher Fleet Cluster Registration Process
CVE-2026-104615

7.9HIGH

Key Information:

Vendor

Suse
Status
Rancher
Vendor
CVE Published:
30 October 2026

What is CVE-2026-104615?

A security flaw has been identified in the cluster registration flow of SUSE Rancher Fleet. The vulnerability allows a registration request to be incorrectly accepted without binding to the associated registration token. This means that an attacker could potentially link a registration request to a managed cluster that was previously registered with a different token, leading to unauthorized access or control over the affected clusters. Ensuring proper token binding is crucial to mitigate this risk and maintain the integrity of cluster management.

Affected Version(s)

Rancher 0.16.0 < 0.16.3

Rancher 0.15.0. < 0.15.17

Rancher 0.14.0 < 0.14.12

References

https://github.com/rancher/fleet/security/advisories/GHSA...
vendor-advisory

CVSS V3.1

Score:
7.9
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

https://github.com/Pig-Tail
.