{"id":"EUVD-2026-42039","enisaUuid":"f752b4bb-2a20-35ec-b30d-bad278c33cd9","description":"A vulnerability has been identified in Fleet\u0027s agent-side deployer, which did not filter security-sensitive keys from namespaceLabels in fleet.yaml (or BundleDeployment.spec.options.namespaceLabels) when applying them to the target namespace.\n\n\n\n\nAn attacker with git push access to a\n Fleet-monitored repository could overwrite Pod Security Standards (PSS)\n enforcement labels on a target namespace. This allows the attacker to \nweaken admission controls and deploy workloads that PSS policies would \notherwise block.","datePublished":"Jul 7, 2026, 1:05:03 PM","dateUpdated":"Jul 8, 2026, 3:56:44 AM","baseScore":8.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","references":"https://bugzilla.suse.com/show_bug.cgi?id\u003dCVE-2026-44938\nhttps://github.com/advisories/GHSA-864g-863m-vcvq\n","aliases":"CVE-2026-44938\nGHSA-864g-863m-vcvq\n","assigner":"suse","epss":0.44,"enisaIdProduct":[{"id":"299c0e78-796e-359b-b108-873cf1474544","product":{"name":"Rancher","vendor":{"name":"SUSE"}},"product_version":"0.12.0 \u003c0.12.15"},{"id":"735f4191-a9c3-3ffe-83d3-043cf69b6741","product":{"name":"Rancher","vendor":{"name":"SUSE"}},"product_version":"0.15.0 \u003c0.15.2"},{"id":"78b6eaf0-991e-3f4e-ba0a-8a0b22fb6ece","product":{"name":"Rancher","vendor":{"name":"SUSE"}},"product_version":"0.14.0 \u003c0.14.6"},{"id":"bbede47f-a365-325f-8260-b43e66910d0b","product":{"name":"Rancher","vendor":{"name":"SUSE"}},"product_version":"0.13.0 \u003c0.13.11"}],"enisaIdVendor":[{"id":"901da572-b024-3da9-bb6a-74dee1c0cb5c","vendor":{"name":"SUSE"}}],"enisaIdVulnerability":[{"id":"19fbdc91-f677-3ebb-a20b-6650112ab5ca","vulnerability":{"id":"CVE-2026-44938","description":"A vulnerability has been identified in Fleet\u0027s agent-side deployer, which did not filter security-sensitive keys from namespaceLabels in fleet.yaml (or BundleDeployment.spec.options.namespaceLabels) when applying them to the target namespace.\n\n\n\n\nAn attacker with git push access to a\n Fleet-monitored repository could overwrite Pod Security Standards (PSS)\n enforcement labels on a target namespace. This allows the attacker to \nweaken admission controls and deploy workloads that PSS policies would \notherwise block.","datePublished":"Jul 7, 2026, 1:05:03 PM","dateUpdated":"Jul 8, 2026, 3:56:44 AM","status":"PUBLISHED","baseScore":8.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","references":"https://bugzilla.suse.com/show_bug.cgi?id\u003dCVE-2026-44938\nhttps://github.com/advisories/GHSA-864g-863m-vcvq\n","enisa_id":"EUVD-2026-42039\n","assigner":"suse","epss":0.44,"dataProcessed":"Oct 30, 2026, 7:18:04 AM","vulnerabilityProduct":[{"id":"01ebbfa5-5d62-3a87-aaaf-9fba84001c49","product":{"name":"Rancher","vendor":{"name":"SUSE"}},"product_version":"0.14.0 \u003c0.14.6"},{"id":"344dc4cf-be6e-31e3-b7bc-e2b7336eed4c","product":{"name":"Rancher","vendor":{"name":"SUSE"}},"product_version":"0.12.0 \u003c0.12.15"},{"id":"3b5cfd20-5648-319a-bc0b-c1b31baa01f4","product":{"name":"Rancher","vendor":{"name":"SUSE"}},"product_version":"0.13.0 \u003c0.13.11"},{"id":"e44e7be2-9920-3df3-a594-ae92b7ef7fc0","product":{"name":"Rancher","vendor":{"name":"SUSE"}},"product_version":"0.15.0 \u003c0.15.2"}],"vulnerabilityVendor":[{"id":"3365678e-fac7-37d9-81a4-8f7e6cb13558","vendor":{"name":"SUSE"}}]}},{"id":"26978420-10e5-3372-9179-47c12acf85a4","vulnerability":{"id":"GHSA-864g-863m-vcvq","description":"Fleet has PSS Bypass through addLabelsFromOptions in Fleet Agent","datePublished":"Jul 1, 2026, 8:35:37 PM","dateUpdated":"Jul 1, 2026, 8:35:37 PM","baseScore":0.0,"references":"https://github.com/rancher/fleet/security/advisories/GHSA-864g-863m-vcvq\nhttps://github.com/rancher/fleet\n","enisa_id":"EUVD-2026-42039\n","aliases":"CVE-2026-44938\nGHSA-864g-863m-vcvq\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:57:47 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}