File Read Vulnerability in SUSE Rancher Fleet
CVE-2026-93537

6.5MEDIUM

Key Information:

Vendor

Suse
Status
Rancher
Vendor
CVE Published:
28 September 2026

What is CVE-2026-93537?

A vulnerability exists in SUSE Rancher Fleet that allows an authenticated user with access to supply bundle content through a GitRepo resource to inadvertently expose sensitive files from the filesystem. This includes sensitive configuration or credential data, such as Helm registry credentials, without proper Kubernetes role-based access control permissions. Attackers can exploit this vulnerability by leveraging permissions to read files that should not be accessible during the bundle-processing job, potentially leading to significant confidentiality breaches.

Affected Version(s)

Rancher 0.16.0 < 0.16.2

Rancher 0.15.0 < 0.15.7

Rancher 0.14.0 < 0.14.11

References

https://github.com/rancher/fleet/security/advisories/GHSA...
vendor-advisory

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

https://github.com/Pig-Tail
.