Live › vulnerability › CVE-2026-104615
Fleet, the Rancher tool that manages groups of Kubernetes clusters, accepted a cluster identity in a registration request without checking it against the registration token used. An attacker can associate a registration with a managed cluster that was originally registered with a different token.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 16:31 UTC. All times on this page are UTC.
Teams that run Rancher Fleet to register and manage downstream Kubernetes clusters are exposed when their Fleet version falls in an affected range. The flaw sits in the cluster registration path, so the exposure depends on whether that path is reachable by untrusted callers in the deployment. Teams not using Fleet, or running a version outside the listed ranges, can skip it.
No product ranges from the sources yet.
kubectl get deployment -n cattle-fleet-system fleet-controller -o jsonpath='{.spec.template.spec.containers[0].image}'0.12, 0.13.0 to 0.13.17, 0.14.0 to 0.14.12, 0.15.0 to 0.15.17, to 0.16.00.16.3Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A security vulnerability was discovered in SUSE Rancher Fleet's cluster registration flow, in Fleet versions before 0.12, 0.13.0 up to 0.13.17, 0.14.0 up to 0.14.12, 0.15.0 up t o 0.15.17 and 0.16.0 up to 0.16.3. The cluster identity claimed by a registration request was accepted without being bound to the registration token that the request was made with. As a result, a registration request could be associated with a managed cluster that was originally registered with a different registration token.
This page as .md · .json · in your agent: get_signal("CVE-2026-104615")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.