High severity8.8NVD Advisory· Published Jul 7, 2026· Updated Oct 20, 2026
CVE-2026-44938
CVE-2026-44938
Description
A vulnerability has been identified in Fleet's agent-side deployer, which did not filter security-sensitive keys from namespaceLabels in fleet.yaml (or BundleDeployment.spec.options.namespaceLabels) when applying them to the target namespace.
An attacker with git push access to a Fleet-monitored repository could overwrite Pod Security Standards (PSS) enforcement labels on a target namespace. This allows the attacker to weaken admission controls and deploy workloads that PSS policies would otherwise block.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/rancher/fleetGo | >= 0.15.0, < 0.15.2 | 0.15.2 |
github.com/rancher/fleetGo | >= 0.14.0, < 0.14.6 | 0.14.6 |
github.com/rancher/fleetGo | >= 0.13.0, < 0.13.11 | 0.13.11 |
github.com/rancher/fleetGo | >= 0.12.0, < 0.12.15 | 0.12.15 |
Affected products
3- osv-coordsRange: < 0.0.20260723T184607-160000.1.1
Patches
Vulnerability mechanics
References
3- github.com/advisories/GHSA-864g-863m-vcvqnvdVendor AdvisoryADVISORY
- bugzilla.suse.com/show_bug.cginvdPermissions Required
- github.com/rancher/fleet/security/advisories/GHSA-864g-863m-vcvqghsaWEB
News mentions
0No linked articles in our index yet.