Network Resource Exposure Vulnerability in Fleet by Rancher

CVE-2026-75036

What is CVE-2026-75036?

A security flaw has been identified in Fleet's Helm template preprocessing, which permits templates evaluated by the Fleet controller to access external network resources beyond the confines of the management cluster. If a user can provide bundle content to a repository linked through a GitRepo resource, they may inadvertently allow the Fleet controller to disclose sensitive cluster metadata. Additionally, this vulnerability can expose reachable hosts from the controller's network position. Notably, the exploitation method relies on name resolution, making the vulnerability a concern even in environments with restricted outbound traffic. While the scope of the disclosure is limited to values available within the Fleet templating context and name resolution results, the incident does not compromise the integrity or availability of the managed clusters.

References