{"id":"CVE-2026-44935","sourceIdentifier":"meissner@suse.de","published":"2026-07-02T17:16:59.667","lastModified":"2026-07-06T12:44:21.767","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Missing validation of \"valuesFrom\" references in Helm Deployer of SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.15 could be used by owners of one tenant to access fleet credentials of other tenants."}],"affected":[{"source":"meissner@suse.de","affectedData":[{"vendor":"SUSE","product":"Rancher","defaultStatus":"unaffected","packageName":"Fleett","repo":"https://github.com/rancher/fleet/","versions":[{"version":"0.15.0","lessThan":"0.15.2","versionType":"semver","status":"affected"},{"version":"0.14.0","lessThan":"0.14.6","versionType":"semver","status":"affected"},{"version":"0.13.0","lessThan":"0.13.11","versionType":"semver","status":"affected"},{"version":"0.12.0","lessThan":"0.12.15","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"meissner@suse.de","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-02T00:00:00+00:00","id":"CVE-2026-44935","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"meissner@suse.de","type":"Secondary","description":[{"lang":"en","value":"CWE-1287"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:suse:rancher_fleet:*:*:*:*:*:*:*:*","versionStartIncluding":"0.12.0","versionEndExcluding":"0.12.15","matchCriteriaId":"8DE7373C-74E0-4B59-AF44-ECB9AC0130B9"},{"vulnerable":true,"criteria":"cpe:2.3:a:suse:rancher_fleet:*:*:*:*:*:*:*:*","versionStartIncluding":"0.13.0","versionEndExcluding":"0.13.11","matchCriteriaId":"D76AA40B-6291-46DC-BE27-BF4B8F6A8B23"},{"vulnerable":true,"criteria":"cpe:2.3:a:suse:rancher_fleet:*:*:*:*:*:*:*:*","versionStartIncluding":"0.14.0","versionEndExcluding":"0.14.6","matchCriteriaId":"F267A8DC-9A24-4A98-B765-CEEC0EBC2576"},{"vulnerable":true,"criteria":"cpe:2.3:a:suse:rancher_fleet:*:*:*:*:*:*:*:*","versionStartIncluding":"0.15.0","versionEndExcluding":"0.15.2","matchCriteriaId":"BE1A7C49-CBBF-45BA-91F1-D2DA940BE908"}]}]}],"references":[{"url":"https://github.com/rancher/fleet/security/advisories/GHSA-xr65-5cpm-g36x","source":"meissner@suse.de","tags":["Vendor Advisory"]}]}