{"id":"EUVD-2026-41867","enisaUuid":"f8657953-cf37-3560-9851-3a9b7db99f54","description":"Potential forgery of webhook requests when using a unauthenticated webhook in SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.5 could be used by remote attackers to cause a denial of service or a downgrade attack on other repositories on the system.","datePublished":"Jul 6, 2026, 9:52:18 AM","dateUpdated":"Jul 6, 2026, 12:46:59 PM","baseScore":8.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/rancher/fleet/security/advisories/GHSA-jmf4-m7j9-g72r\n","aliases":"CVE-2026-44937\nGHSA-jmf4-m7j9-g72r\n","assigner":"suse","epss":0.42,"enisaIdProduct":[{"id":"0dd73c4e-909b-3b42-9473-fa767a81a057","product":{"name":"Rancher","vendor":{"name":"SUSE"}},"product_version":"0.12.0 \u003c0.12.15"},{"id":"1145394c-fca4-3f0f-9a8c-fe299fb2eb10","product":{"name":"Rancher","vendor":{"name":"SUSE"}},"product_version":"0.13.0 \u003c0.13.11"},{"id":"99adbe1e-05f5-3103-904f-0fc6ca799935","product":{"name":"Rancher","vendor":{"name":"SUSE"}},"product_version":"0.15.0 \u003c0.15.2"},{"id":"ddbbadd1-3938-34e6-8ce3-54e2c14df32a","product":{"name":"Rancher","vendor":{"name":"SUSE"}},"product_version":"0.14.0 \u003c0.14.6"}],"enisaIdVendor":[{"id":"a0a91951-29bd-3bba-8788-8ce4a0c9478e","vendor":{"name":"SUSE"}}],"enisaIdVulnerability":[{"id":"3c1f7ec2-1c75-3e8b-b01c-f898733f84e9","vulnerability":{"id":"GHSA-jmf4-m7j9-g72r","description":"Rancher Fleet has Unauthenticated Webhook: Regex Injection via Unsanitized Repository URL Components","datePublished":"Jul 1, 2026, 8:44:24 PM","dateUpdated":"Jul 1, 2026, 8:44:24 PM","baseScore":0.0,"references":"https://github.com/rancher/fleet/security/advisories/GHSA-jmf4-m7j9-g72r\nhttps://github.com/rancher/fleet\n","enisa_id":"EUVD-2026-41867\n","aliases":"CVE-2026-44937\nGHSA-jmf4-m7j9-g72r\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:02:28 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"7eb60405-903f-368e-8136-9a59fc74fd13","vulnerability":{"id":"CVE-2026-44937","description":"Potential forgery of webhook requests when using a unauthenticated webhook in SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.5 could be used by remote attackers to cause a denial of service or a downgrade attack on other repositories on the system.","datePublished":"Jul 6, 2026, 9:52:18 AM","dateUpdated":"Jul 6, 2026, 12:46:59 PM","status":"PUBLISHED","baseScore":8.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/rancher/fleet/security/advisories/GHSA-jmf4-m7j9-g72r\n","enisa_id":"EUVD-2026-41867\n","assigner":"suse","epss":0.42,"dataProcessed":"Nov 1, 2026, 7:18:42 AM","vulnerabilityProduct":[{"id":"0e53dde6-12b1-3f67-bb5a-0828367fb9bb","product":{"name":"Rancher","vendor":{"name":"SUSE"}},"product_version":"0.14.0 \u003c0.14.6"},{"id":"782b9a65-944c-369b-8ca6-210b97ad2bed","product":{"name":"Rancher","vendor":{"name":"SUSE"}},"product_version":"0.12.0 \u003c0.12.15"},{"id":"cc5d57d9-b272-3490-ac73-861bbe8ae31e","product":{"name":"Rancher","vendor":{"name":"SUSE"}},"product_version":"0.13.0 \u003c0.13.11"},{"id":"cdb2dfac-07ea-38de-93bf-1ed4fbaccb70","product":{"name":"Rancher","vendor":{"name":"SUSE"}},"product_version":"0.15.0 \u003c0.15.2"}],"vulnerabilityVendor":[{"id":"8e875fdd-41f7-3916-967b-c602e79b87a9","vendor":{"name":"SUSE"}}]}}],"enisaIdAdvisory":[]}