Live › vulnerability › CVE-2026-94290
Rancher Fleet's controller did not restrict which kubeconfig secrets a Fleet Cluster object may reference. A user who can create a Fleet cluster in a namespace they control can get the controller to act on the management cluster with administrative credentials and run their content there with elevated privileges.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 16:24 UTC. All times on this page are UTC.
Self-hosted Rancher installations running Fleet in the affected ranges are exposed in the default configuration. Fleet is on by default and ordinary users can create Fleet workspaces, so any authenticated Rancher user with the default user global role could get cluster-admin on the management cluster, and from there the credentials of every downstream cluster. Installations that already restricted Fleet workspace self-service reduce exposure. Standalone Fleet use with only trusted admins creating Cluster objects is lower risk.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| fleet | go | >=0.13.0 <0.13.17, >=0.14.0 <0.14.12, >=0.15.0 <0.15.8, >=0.16.0 <0.16.3 | 0.13.17, 0.14.12, 0.15.8, 0.16.3 |
| rancher | vendor | bundled Fleet in releases before the patched ones | 2.15.3, 2.14.7, 2.13.11, 2.12.15 |
0.16.3, 0.15.8, 0.14.12 or 0.13.17, together with Rancher 2.15.3, 2.14.7, 2.13.11 or 2.12.15 (the Rancher release carries a compatibility change)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
SUSE Rancher Fleet clusters reference a kubeconfig secret that the controller uses to install and manage a Fleet agent on the target cluster. The controller did not sufficiently restrict which kubeconfig secrets a Fleet Cluster object was allowed to reference. As a result, a Fleet cluster defined in a namespace an ordinary user controls could be associated with administrative credentials for the management cluster itself, causing the controller to manage the management cluster on that user's behalf and to run that user's Fleet content there with elevated privileges. This affects SUSE Rancher Fleet 0.16.0 up to 0.16.3, 0.15.0 up to 0.15.8, 0.14.0 up to 0.14.12, 0.13.0 up to 0.13.17 and possible older versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-94290")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.