{"id":"CVE-2026-44937","revision":"dc2f134d93c647ddb0644bb4e8647d93","records":[{"revision":"dc2f134d93c647ddb0644bb4e8647d93","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-44937","aliases":[],"title":"SUSE Rancher Fleet had an Unauthenticated Webhook: Regex Injection via Unsanitized Repository URL Components","description":"Potential forgery of webhook requests when using a unauthenticated webhook in SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.5 could be used by remote attackers to cause a denial of service or a downgrade attack on other repositories on the system.","state":0,"publishedAt":"2026-07-06T09:52:18.659+00:00","modifiedAt":"2026-07-06T12:46:59.551+00:00","affected":[{"ecosystem":"Vendor product","name":"Fleet","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"SUSE\",\n                    \"product\": \"Rancher\",\n                    \"packageName\": \"Fleet\",\n                    \"repo\": \"https://github.com/rancher/fleet/\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"0.15.0\",\n                            \"lessThan\": \"0.15.2\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"0.14.0\",\n                            \"lessThan\": \"0.14.6\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"0.13.0\",\n                            \"lessThan\": \"0.13.11\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"0.12.0\",\n                            \"lessThan\": \"0.12.15\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N","score":8.3,"severity":"HIGH"}],"references":["https://github.com/rancher/fleet/security/advisories/GHSA-jmf4-m7j9-g72r"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-44937","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-44937","identifiers":["CVE-2026-44937"]},"retained":false,"historicalAffected":[]}],"coverage":[]}