{"id":"CVE-2026-44938","sourceIdentifier":"meissner@suse.de","published":"2026-07-07T14:16:30.690","lastModified":"2026-10-25T20:10:00.147","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability has been identified in Fleet's agent-side deployer, which did not filter security-sensitive keys from namespaceLabels in fleet.yaml (or BundleDeployment.spec.options.namespaceLabels) when applying them to the target namespace.\n\n\n\n\nAn attacker with git push access to a\n Fleet-monitored repository could overwrite Pod Security Standards (PSS)\n enforcement labels on a target namespace. This allows the attacker to \nweaken admission controls and deploy workloads that PSS policies would \notherwise block."},{"lang":"es","value":"Una vulnerabilidad ha sido identificada en el desplegador del lado del agente de Fleet, que no filtraba claves sensibles a la seguridad de namespaceLabels en fleet.yaml (o BundleDeployment.spec.options.namespaceLabels) al aplicarlas al espacio de nombres objetivo.\n\nUn atacante con acceso de git push a un repositorio monitorizado por Fleet podría sobrescribir las etiquetas de aplicación de los Estándares de Seguridad de Pods (PSS) en un espacio de nombres objetivo. Esto permite al atacante debilitar los controles de admisión y desplegar cargas de trabajo que las políticas PSS bloquearían de otro modo."}],"affected":[{"source":"meissner@suse.de","affectedData":[{"vendor":"SUSE","product":"Rancher","defaultStatus":"unaffected","packageName":"github.com/rancher/fleet","versions":[{"version":"0.15.0","lessThan":"0.15.2","versionType":"semver","status":"affected"},{"version":"0.14.0","lessThan":"0.14.6","versionType":"semver","status":"affected"},{"version":"0.13.0","lessThan":"0.13.11","versionType":"semver","status":"affected"},{"version":"0.12.0","lessThan":"0.12.15","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"meissner@suse.de","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-07T00:00:00+00:00","id":"CVE-2026-44938","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"meissner@suse.de","type":"Secondary","description":[{"lang":"en","value":"CWE-522"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:suse:rancher_fleet:*:*:*:*:*:*:*:*","versionStartIncluding":"0.12.0","versionEndExcluding":"0.12.15","matchCriteriaId":"8DE7373C-74E0-4B59-AF44-ECB9AC0130B9"},{"vulnerable":true,"criteria":"cpe:2.3:a:suse:rancher_fleet:*:*:*:*:*:*:*:*","versionStartIncluding":"0.13.0","versionEndExcluding":"0.13.11","matchCriteriaId":"D76AA40B-6291-46DC-BE27-BF4B8F6A8B23"},{"vulnerable":true,"criteria":"cpe:2.3:a:suse:rancher_fleet:*:*:*:*:*:*:*:*","versionStartIncluding":"0.14.0","versionEndExcluding":"0.14.6","matchCriteriaId":"F267A8DC-9A24-4A98-B765-CEEC0EBC2576"},{"vulnerable":true,"criteria":"cpe:2.3:a:suse:rancher_fleet:*:*:*:*:*:*:*:*","versionStartIncluding":"0.15.0","versionEndExcluding":"0.15.2","matchCriteriaId":"BE1A7C49-CBBF-45BA-91F1-D2DA940BE908"}]}]}],"references":[{"url":"https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-44938","source":"meissner@suse.de","tags":["Permissions Required"]},{"url":"https://github.com/advisories/GHSA-864g-863m-vcvq","source":"meissner@suse.de","tags":["Vendor Advisory"]}]}