Privilege Mismatch Vulnerability in Rancher Fleet by SUSE
CVE-2026-93540

6.5MEDIUM

Key Information:

Vendor

Suse
Status
Rancher
Vendor
CVE Published:
28 September 2026

What is CVE-2026-93540?

A privilege mismatch in SUSE Rancher Fleet allows unauthorized users to alter namespace labels and annotations without proper authorization checks. This occurs when a bundle requests metadata updates via the namespaceLabels and namespaceAnnotations options, potentially compromising the integrity of deployed namespaces. Versions below 0.16.2, 0.15.7, 0.14.11, and 0.13.16 are particularly vulnerable, with older versions likely affected as well.

Affected Version(s)

Rancher 0.16.0 < 0.16.1

Rancher 0.15.0 < 0.15.7

Rancher 0.14.0 < 0.14.11

References

https://github.com/rancher/fleet/security/advisories/GHSA...
vendor-advisory

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

g.mygenie@gmail.com
.