Vulnerability in Fleet Agent-Side Deployer Affects Security Control on Target Namespace

CVE-2026-44938

What is CVE-2026-44938?

A vulnerability has been discovered in Fleet's agent-side deployer that fails to properly filter security-sensitive keys from namespaceLabels within the fleet.yaml configuration file. This oversight allows an attacker with git push access to a Fleet-monitored repository to overwrite important Pod Security Standards (PSS) enforcement labels in the target namespace. Consequently, the attacker can reduce the effectiveness of admission controls, facilitating the deployment of workloads that PSS policies would typically prevent.

References