Kubeconfig Secret Reference Vulnerability in SUSE Rancher Fleet
CVE-2026-94290

9.1CRITICAL

Key Information:

Vendor

Suse
Status
Rancher
Vendor
CVE Published:
2 November 2026

What is CVE-2026-94290?

An access control misconfiguration exists in SUSE Rancher Fleet, where the controller allows Fleet Cluster objects to reference kubeconfig secrets without proper restrictions. This can enable an ordinary user to associate their Fleet cluster in a controlled namespace with administrative credentials of the management cluster. Consequently, this security flaw permits the unauthorized management of the management cluster and the execution of Fleet content with elevated privileges by users who should not have such access. This impacts multiple versions of Rancher Fleet from 0.13.0 to 0.16.3 and earlier versions.

Affected Version(s)

Rancher 0.16.0 < 0.16.3

Rancher 0.15.0 < 0.15.8

Rancher 0.14.0 < 0.14.12

References

https://github.com/rancher/fleet/security/advisories/GHSA...
vendor-advisory

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Kenzie Cuttler
.