---
id: "CVE-2026-94290"
kind: "vulnerability"
aliases: ["CVE-2026-94290"]
title: "SUSE Rancher Fleet: an ordinary Rancher user can get cluster-admin on the management cluster"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "fleet", "fixed": ["0.13.17", "0.14.12", "0.15.8", "0.16.3"], "affected": ">=0.13.0 <0.13.17, >=0.14.0 <0.14.12, >=0.15.0 <0.15.8, >=0.16.0 <0.16.3", "ecosystem": "go"}, {"name": "rancher", "fixed": ["2.15.3", "2.14.7", "2.13.11", "2.12.15"], "affected": "bundled Fleet in releases before the patched ones", "ecosystem": "vendor"}]
ecosystems: []
tags: ["fleet", "infrastructure", "kubernetes", "privilege-escalation", "rancher", "self-hosted"]
not_affected_if: ["default-config", "fleet-disabled", "single-tenant-admins-only", "workspace-self-service-restricted"]
published_at: "2026-11-02T16:17:45+00:00"
first_seen_at: "2026-11-02T16:24:05+00:00"
updated_at: "2026-11-02T16:27:05+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94290", "first_seen_at": "2026-11-02T16:24:05+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-02T16:27:05+00:00"}]
---

# SUSE Rancher Fleet: an ordinary Rancher user can get cluster-admin on the management cluster

Rancher Fleet's controller did not restrict which kubeconfig secrets a Fleet Cluster object may reference. A user who can create a Fleet cluster in a namespace they control can get the controller to act on the management cluster with administrative credentials and run their content there with elevated privileges.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:fleet affected >=0.13.0 <0.13.17, >=0.14.0 <0.14.12, >=0.15.0 <0.15.8, >=0.16.0 <0.16.3 fixed 0.13.17, 0.14.12, 0.15.8, 0.16.3
- vendor:rancher affected bundled Fleet in releases before the patched ones fixed 2.15.3, 2.14.7, 2.13.11, 2.12.15

## How to check

- Find the Fleet version: kubectl get deployment -n cattle-fleet-system fleet-controller -o jsonpath='{.spec.template.spec.containers[0].image}'. Affected: Fleet >=0.13.0 <0.13.17, >=0.14.0 <0.14.12, >=0.15.0 <0.15.8, >=0.16.0 <0.16.3.
- Check whether ordinary users can create fleetworkspaces (management.cattle.io) or write fleet.cattle.io clusters/bundles in non-system namespaces.
- Look for unexpected Fleet agent namespaces or deployments and new cluster-admin ClusterRoleBindings on the local cluster.

## Fix

Upgrade Fleet to 0.16.3, 0.15.8, 0.14.12 or 0.13.17, together with Rancher 2.15.3, 2.14.7, 2.13.11 or 2.12.15 (the Rancher release carries a compatibility change). After upgrading, Fleet Clusters that reference a kubeconfig secret in another namespace stop importing until that secret is labeled fleet.cattle.io/kubeconfig-referenceable-from=<cluster namespace>. Temporary option: Helm value allowUnlabeledKubeConfigSecretNamespaces: true, which weakens the protection.

## Timeline

- 2026-11-02T16:24:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-94290
- 2026-11-02T16:27:05+00:00 analyst — Read GHSA-qfmw-gw96-ffcr: fixed Fleet 0.16.3/0.15.8/0.14.12/0.13.17 (advisory says affected is below those; NVD text 'up to' is ambiguous). Default config is affected, so removed default-config from not-affected-if. Rancher fixed in 2.15.3/2.14.7/2.13.11/2.12.15. No exploitation or PoC stated; social search not done.

## Documents

- [advisory] Vendor advisory: github.com https://github.com/rancher/fleet/security/advisories/GHSA-qfmw-gw96-ffcr

## From the sources

SUSE Rancher Fleet clusters reference a kubeconfig secret that the controller uses to install and manage a Fleet agent on the target cluster. The controller did not sufficiently restrict which kubeconfig secrets a Fleet Cluster object was allowed to reference. As a result, a Fleet cluster defined in a namespace an ordinary user controls could be associated with administrative credentials for the management cluster itself, causing the controller to manage the management cluster on that user's behalf and to run that user's Fleet content there with elevated privileges. This affects SUSE Rancher Fleet 0.16.0 up to 0.16.3, 0.15.0 up to 0.15.8, 0.14.0 up to 0.14.12, 0.13.0 up to 0.13.17 and possible older versions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_