{"id":"CVE-2026-94290","kind":"vulnerability","aliases":["CVE-2026-94290"],"related":[],"title":"SUSE Rancher Fleet: an ordinary Rancher user can get cluster-admin on the management cluster","description":"SUSE Rancher Fleet clusters reference a kubeconfig secret that the controller uses to install and manage a Fleet agent on the target cluster. The controller did not sufficiently restrict which kubeconfig secrets a Fleet Cluster object was allowed to reference. As a result, a Fleet cluster defined in a namespace an ordinary user controls could be associated with administrative credentials for the management cluster itself, causing the controller to manage the management cluster on that user's behalf and to run that user's Fleet content there with elevated privileges. This affects SUSE Rancher Fleet 0.16.0 up to 0.16.3, 0.15.0 up to 0.15.8, 0.14.0 up to 0.14.12, 0.13.0 up to 0.13.17 and possible older versions.","summary":"Rancher Fleet's controller did not restrict which kubeconfig secrets a Fleet Cluster object may reference. A user who can create a Fleet cluster in a namespace they control can get the controller to act on the management cluster with administrative credentials and run their content there with elevated privileges.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"fleet","fixed":["0.13.17","0.14.12","0.15.8","0.16.3"],"affected":">=0.13.0 <0.13.17, >=0.14.0 <0.14.12, >=0.15.0 <0.15.8, >=0.16.0 <0.16.3","ecosystem":"go"},{"name":"rancher","fixed":["2.15.3","2.14.7","2.13.11","2.12.15"],"affected":"bundled Fleet in releases before the patched ones","ecosystem":"vendor"}],"ecosystems":[],"tags":["fleet","infrastructure","kubernetes","privilege-escalation","rancher","self-hosted"],"not_affected_if":["default-config","fleet-disabled","single-tenant-admins-only","workspace-self-service-restricted"],"how_to_check":"- Find the Fleet version: kubectl get deployment -n cattle-fleet-system fleet-controller -o jsonpath='{.spec.template.spec.containers[0].image}'. Affected: Fleet >=0.13.0 <0.13.17, >=0.14.0 <0.14.12, >=0.15.0 <0.15.8, >=0.16.0 <0.16.3.\n- Check whether ordinary users can create fleetworkspaces (management.cattle.io) or write fleet.cattle.io clusters/bundles in non-system namespaces.\n- Look for unexpected Fleet agent namespaces or deployments and new cluster-admin ClusterRoleBindings on the local cluster.","fix":"Upgrade Fleet to 0.16.3, 0.15.8, 0.14.12 or 0.13.17, together with Rancher 2.15.3, 2.14.7, 2.13.11 or 2.12.15 (the Rancher release carries a compatibility change). After upgrading, Fleet Clusters that reference a kubeconfig secret in another namespace stop importing until that secret is labeled fleet.cattle.io/kubeconfig-referenceable-from=<cluster namespace>. Temporary option: Helm value allowUnlabeledKubeConfigSecretNamespaces: true, which weakens the protection.","status":"open","published_at":"2026-11-02T16:17:45+00:00","first_seen_at":"2026-11-02T16:24:05+00:00","triaged_at":"2026-11-02T16:26:18+00:00","updated_at":"2026-11-02T16:27:05+00:00","category":"infrastructure","confidence":0.9,"triage":{"at":"2026-11-02T16:26:18Z","model":"claude-haiku-5-5","output":{"fix":"- Fleet `0.16.4` or later for the 0.16 line\n- Fleet `0.15.9` or later for the 0.15 line\n- Fleet `0.14.13` or later for the 0.14 line\n- Fleet `0.13.18` or later for the 0.13 line","reach":"network","title":"SUSE Rancher Fleet: a user can reach management cluster admin credentials","impact":"high","summary":"Rancher Fleet's controller did not restrict which kubeconfig secrets a Fleet Cluster object may reference. A user who can create a Fleet cluster in a namespace they control can get the controller to act on the management cluster with administrative credentials and run their content there with elevated privileges.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["rancher","fleet","kubernetes","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker gets management cluster admin credentials and runs code there","analyst_note":"Confirm the exact fixed versions and whether older releases are affected, using the vendor advisory linked in the sources.","how_to_check":"- Check the installed Fleet version in the Rancher management cluster, for example with `kubectl get deployment -n cattle-fleet-system fleet-controller -o jsonpath='{.spec.template.spec.containers[0].image}'`\n- Check which users can create Fleet Cluster objects in their own namespaces, and whether any of those cluster objects reference kubeconfig secrets.","plain_action":"","needs_analyst":true,"not_affected_if":["default-config","single-tenant-admins-only"],"who_is_affected":"Teams running SUSE Rancher with Fleet in the affected version ranges are exposed, since the flaw lets a namespace user reach the management cluster's credentials. Exposure depends on whether untrusted or multi-tenant users can create Fleet Cluster objects; single-tenant setups where only administrators create them are at lower risk. Older versions than those listed may also be affected according to the source.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000803,"input_tokens":4311,"output_tokens":743,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the exact fixed versions and whether older releases are affected, using the vendor advisory linked in the sources.","search":"'-2026':18A,21A '-94290':19A,22A '0.13.0':192C '0.13.17':195C '0.14.0':188C '0.14.12':191C '0.15.0':184C '0.15.8':187C '0.16.0':180C '0.16.3':183C 'act':69B 'admin':12A 'administr':75B,143C 'affect':176C 'agent':103C 'allow':122C 'associ':141C 'behalf':162C 'caus':150C 'cluster':11A,16A,47B,58B,73B,88C,107C,119C,130C,148C,157C 'cluster-admin':10A 'content':80B,170C 'control':38B,63B,67B,95C,109C,138C,152C 'could':139C 'creat':55B 'credenti':76B,144C 'cve':17A,20A 'defin':131C 'elev':83B,173C 'escal':30B 'fleet':3A,23A,25B,36B,46B,57B,87C,102C,118C,129C,169C,179C 'get':9A,65B 'host':34B 'infrastructur':26B 'instal':98C 'kubeconfig':43B,91C,115C 'kubernet':27B 'manag':15A,72B,100C,147C,154C,156C 'may':49B 'namespac':61B,134C 'object':48B,120C 'older':198C 'ordinari':5A,136C 'possibl':197C 'privileg':29B,84B,174C 'privilege-escal':28B 'rancher':2A,6A,24A,31B,35B,86C,178C 'refer':50B,89C,124C 'restrict':41B,113C 'result':127C 'run':78B,165C 'secret':44B,92C,116C 'self':33B 'self-host':32B 'suffici':112C 'suse':1A,85C,177C 'target':106C 'use':96C 'user':7A,52B,137C,160C,167C 'version':199C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Rancher installations running Fleet in the affected ranges are exposed in the default configuration. Fleet is on by default and ordinary users can create Fleet workspaces, so any authenticated Rancher user with the default user global role could get cluster-admin on the management cluster, and from there the credentials of every downstream cluster. Installations that already restricted Fleet workspace self-service reduce exposure. Standalone Fleet use with only trusted admins creating Cluster objects is lower risk.","tier":"B","verified":{"fix":{"at":"2026-11-02T16:27:05Z","by":"analyst","doc":"https://github.com/rancher/fleet/security/advisories/GHSA-qfmw-gw96-ffcr","run_id":1386},"products":{"at":"2026-11-02T16:27:05Z","by":"analyst","doc":"https://github.com/rancher/fleet/security/advisories/GHSA-qfmw-gw96-ffcr","run_id":1386},"workarounds":{"at":"2026-11-02T16:27:05Z","by":"analyst","doc":"https://github.com/rancher/fleet/security/advisories/GHSA-qfmw-gw96-ffcr","run_id":1386},"how_to_check":{"at":"2026-11-02T16:27:05Z","by":"analyst","doc":"https://github.com/rancher/fleet/security/advisories/GHSA-qfmw-gw96-ffcr","run_id":1386},"who_affected":{"at":"2026-11-02T16:27:05Z","by":"analyst","doc":"https://github.com/rancher/fleet/security/advisories/GHSA-qfmw-gw96-ffcr","run_id":1386}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["fleet","rancher"],"ptokens":["fleet","rancher"],"labels":["critical","fleet","infrastructure","kubernetes","privilegeescalation","rancher","selfhosted"],"first_public_at":"2026-10-29T17:26:09+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cvss_by":"meissner@suse.de","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-94290","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94290","severity":null,"published_at":"2026-11-02T16:17:45+00:00","modified_at":"2026-11-02T16:17:45+00:00","first_seen_at":"2026-11-02T16:24:05+00:00","fetched_at":"2026-11-02T16:24:05+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-94290:1386","url":null,"severity":null,"published_at":"2026-11-02T16:27:05+00:00","modified_at":"2026-11-02T16:27:05+00:00","first_seen_at":"2026-11-02T16:27:05+00:00","fetched_at":"2026-11-02T16:27:05+00:00","note":"Read GHSA-qfmw-gw96-ffcr: fixed Fleet 0.16.3/0.15.8/0.14.12/0.13.17 (advisory says affected is below those; NVD text 'up to' is ambiguous). Default config is affected, so removed default-config from not-affected-if. Rancher fixed in 2.15.3/2.14.7/2.13.11/2.12.15. No exploitation or PoC stated; social search not done."}],"documents":[{"id":52778,"url":"https://github.com/rancher/fleet/security/advisories/GHSA-qfmw-gw96-ffcr","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-29T17:26:09+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}