Moderate severityNVD Advisory· Published Jul 6, 2026· Updated Jul 6, 2026
Rancher Fleet SSRF in Bundle Reader via Unvalidated Helm Repository URL in fleet.yaml
CVE-2026-44936
Description
Missing filtering when the helmRepoURLRegex field isn't set on a GitRepo resource in SUSE Rancher Fleet's bundle reader in 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.15 forwards Helm authentication credentials (BasicAuth) to any URL specified in the helm.repo field of a fleet.yaml file, allowing attackers able to push to fleet monitored git repos to leak helm access credentials.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/rancher/fleetGo | >= 0.15.0, < 0.15.2 | 0.15.2 |
github.com/rancher/fleetGo | >= 0.14.0, < 0.14.6 | 0.14.6 |
github.com/rancher/fleetGo | >= 0.13.0, < 0.13.11 | 0.13.11 |
github.com/rancher/fleetGo | >= 0.12.0, < 0.12.15 | 0.12.15 |
Patches
Vulnerability mechanics
References
2- github.com/advisories/GHSA-hx4v-cxpf-vh8mghsavendor-advisoryADVISORY
- github.com/rancher/fleet/security/advisories/GHSA-hx4v-cxpf-vh8mghsaWEB
News mentions
0No linked articles in our index yet.