{"id":"EUVD-2026-29917","enisaUuid":"9a019e87-b9ac-3a34-bc81-990974632bd9","description":"Fleet\u0027s Helm deployer did not fully apply ServiceAccount impersonation in two code paths, allowing a tenant with git push access to a Fleet-monitored repository to read secrets from any namespace on every downstream cluster targeted by their `GitRepo`.","datePublished":"May 13, 2026, 8:04:57 AM","dateUpdated":"May 14, 2026, 3:55:58 AM","baseScore":9.9,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","references":"https://bugzilla.suse.com/show_bug.cgi?id\u003dCVE-2026-41050\nhttps://github.com/advisories/GHSA-765j-qfrp-hm3j\n","aliases":"CVE-2026-41050\nGHSA-765j-qfrp-hm3j\n","assigner":"suse","epss":0.39,"enisaIdProduct":[{"id":"2f9eb714-f8b2-30c9-aaa7-8f8b5a361cba","product":{"name":"Rancher","vendor":{"name":"SUSE"}},"product_version":"0.11.0 \u003c0.11.13"},{"id":"8118adae-166f-3eee-bf01-ab5b55fd9707","product":{"name":"Rancher","vendor":{"name":"SUSE"}},"product_version":"0.14.0 \u003c0.14.5"},{"id":"b6d27c40-69ff-384a-9665-b13a46d6797b","product":{"name":"Rancher","vendor":{"name":"SUSE"}},"product_version":"0.13.0 \u003c0.13.10"},{"id":"fa53bc27-acaf-3c72-9e91-b6f1fc7d11e5","product":{"name":"Rancher","vendor":{"name":"SUSE"}},"product_version":"0.15.0 \u003c0.15.1"},{"id":"fe740d9f-2965-360b-9ca5-6a378f406c4e","product":{"name":"Rancher","vendor":{"name":"SUSE"}},"product_version":"0.12.0 \u003c0.12.14"}],"enisaIdVendor":[{"id":"c67a635b-3a34-33be-a896-6080a80c001d","vendor":{"name":"SUSE"}}],"enisaIdVulnerability":[{"id":"407400d2-9f50-37b1-a12e-8e2a7f9f6b3e","vulnerability":{"id":"GHSA-765j-qfrp-hm3j","description":"Fleet: Helm impersonation bypass of `RESTClientGetter` retains `cluster-admin` during template rendering","datePublished":"May 7, 2026, 1:26:06 AM","dateUpdated":"May 14, 2026, 8:31:35 PM","baseScore":0.0,"references":"https://github.com/rancher/fleet/security/advisories/GHSA-765j-qfrp-hm3j\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-41050\nhttps://bugzilla.suse.com/show_bug.cgi?id\u003dCVE-2026-41050\nhttps://github.com/rancher/fleet\n","enisa_id":"EUVD-2026-29917\n","aliases":"CVE-2026-41050\nGHSA-765j-qfrp-hm3j\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:50 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"479879aa-52e3-321f-bdea-e4b93c56f950","vulnerability":{"id":"CVE-2026-41050","description":"Fleet\u0027s Helm deployer did not fully apply ServiceAccount impersonation in two code paths, allowing a tenant with git push access to a Fleet-monitored repository to read secrets from any namespace on every downstream cluster targeted by their `GitRepo`.","datePublished":"May 13, 2026, 8:04:57 AM","dateUpdated":"May 14, 2026, 3:55:58 AM","status":"PUBLISHED","baseScore":9.9,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","references":"https://bugzilla.suse.com/show_bug.cgi?id\u003dCVE-2026-41050\nhttps://github.com/advisories/GHSA-765j-qfrp-hm3j\n","enisa_id":"EUVD-2026-29917\n","assigner":"suse","epss":0.39,"dataProcessed":"Oct 27, 2026, 7:16:42 AM","vulnerabilityProduct":[{"id":"0b5af69f-8a3e-3a59-bf04-b1bbdc10e8a7","product":{"name":"Rancher","vendor":{"name":"SUSE"}},"product_version":"0.15.0 \u003c0.15.1"},{"id":"0d1c9819-284b-3031-b39b-01e8fa6fb50b","product":{"name":"Rancher","vendor":{"name":"SUSE"}},"product_version":"0.11.0 \u003c0.11.13"},{"id":"1d107662-cbbb-373b-a784-cd8596496e10","product":{"name":"Rancher","vendor":{"name":"SUSE"}},"product_version":"0.14.0 \u003c0.14.5"},{"id":"7560be3a-a231-3965-8f20-8670aa391f61","product":{"name":"Rancher","vendor":{"name":"SUSE"}},"product_version":"0.12.0 \u003c0.12.14"},{"id":"ecc89d76-6806-3341-b1a6-5823b1df491c","product":{"name":"Rancher","vendor":{"name":"SUSE"}},"product_version":"0.13.0 \u003c0.13.10"}],"vulnerabilityVendor":[{"id":"c2a532fd-f7c2-3c0e-8460-d9d7277523be","vendor":{"name":"SUSE"}}]}}],"enisaIdAdvisory":[]}