Medium severity5.0OSV Advisory· Published Jul 6, 2026· Updated Jul 9, 2026
CVE-2026-44936
CVE-2026-44936
Description
Missing filtering when the helmRepoURLRegex field isn't set on a GitRepo resource in SUSE Rancher Fleet's bundle reader in 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.15 forwards Helm authentication credentials (BasicAuth) to any URL specified in the helm.repo field of a fleet.yaml file, allowing attackers able to push to fleet monitored git repos to leak helm access credentials.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/rancher/fleetGo | >= 0.15.0, < 0.15.2 | 0.15.2 |
github.com/rancher/fleetGo | >= 0.14.0, < 0.14.6 | 0.14.6 |
github.com/rancher/fleetGo | >= 0.13.0, < 0.13.11 | 0.13.11 |
github.com/rancher/fleetGo | >= 0.12.0, < 0.12.15 | 0.12.15 |
Affected products
5cpe:2.3:a:suse:rancher_fleet:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:suse:rancher_fleet:*:*:*:*:*:*:*:*range: >=0.12.0,<0.12.15
- (no CPE)range: <0.15.2, <0.14.6, <0.13.11, <0.12.15
- osv-coordsRange: < 0.0.20260723T184607-160000.1.1
Patches
Vulnerability mechanics
References
2- github.com/advisories/GHSA-hx4v-cxpf-vh8mnvdExploitThird Party AdvisoryMitigationADVISORY
- github.com/rancher/fleet/security/advisories/GHSA-hx4v-cxpf-vh8mghsaWEB
News mentions
0No linked articles in our index yet.