CVE-2026-93538 Cross-tenant BundleDeployment and Secret disclosure via spoofed cluster labels during agent-initiated registration in Fleet

A cross-tenant authorization issue was discovered in SUSE Rancher Fleet. During agent-initiated cluster registration, cluster labels supplied by the registering agent, including labels in the reserved management.cattle.io/ namespace such as the cluster display name label, were applied to the...

CVE-2026-93538

SUSE Rancher Fleet contains a cross-tenant authorization issue where cluster labels supplied by a registering agent are incorrectly applied to the upstream Cluster object. This includes labels in the reserved management.cattle.io/ namespace, such as the cluster display name. Because Fleet uses th...

CVE-2026-93538 Cross-tenant BundleDeployment and Secret disclosure via spoofed cluster labels during agent-initiated registration in Fleet

A cross-tenant authorization issue was discovered in SUSE Rancher Fleet. During agent-initiated cluster registration, cluster labels supplied by the registering agent, including labels in the reserved management.cattle.io/ namespace such as the cluster display name label, were applied to the...

CVE-2026-93538 Cross-tenant BundleDeployment and Secret disclosure via spoofed cluster labels during agent-initiated registration in Fleet

A cross-tenant authorization issue was discovered in SUSE Rancher Fleet. During agent-initiated cluster registration, cluster labels supplied by the registering agent, including labels in the reserved management.cattle.io/ namespace such as the cluster display name label, were applied to the...

PT-2026-99921

Name of the Vulnerable Software and Affected Versions SUSE Rancher Fleet versions 0.16 through 0.16.1 SUSE Rancher Fleet versions 0.15 through 0.15.6 SUSE Rancher Fleet versions 0.14 through 0.14.10 Description An issue exists in Rancher Manager where the Fleet agent utilizes its own cluster-admi...

PT-2026-99869

Name of the Vulnerable Software and Affected Versions NooBaa affected versions not specified Description An OS command injection flaw exists in the set hostname internal function of the 'cluster internal api' component, which manages the Multi-Cloud Object Gateway in OpenShift Data Foundation. Th...

PT-2026-99904

Name of the Vulnerable Software and Affected Versions SUSE Rancher Fleet versions prior to 0.16.1 SUSE Rancher Fleet versions prior to 0.15.6 SUSE Rancher Fleet versions prior to 0.14.10 SUSE Rancher Fleet versions prior to 0.13.15 SUSE Rancher Fleet versions prior to 0.12.19 Description A...

CVE-2026-93538: Authentication Bypass by Spoofing

A cross-tenant authorization issue was discovered in SUSE Rancher Fleet. During agent-initiated cluster registration, cluster labels supplied by the registering agent, including labels in the reserved management.cattle.io/ namespace such as the cluster display name label, were applied to the...

CVE-2026-53493 vulnerabilities

Vulnerabilities for packages: k8sgpt, wolfictl, spegel, trivy, helm-mapkubeapis, chartmuseum, zarf, helm-set-status, xeol, neuvector-scanner, buildkitd, rancher, headlamp, scorecard, helm-operator, docker-compose, k9s, falco-no-driver, helm-push, skaffold, eksctl, kubescape, kubevela,...

CVE-2026-100706

kyverno before 1.19.1 fails to properly validate URL-encoded path segments in Policy apiCall urlPath, allowing namespace tenants to bypass the per-namespace clamp and create objects in other namespaces as the admission-controller ServiceAccount. Attackers can exploit this by using percent-encoded...

CVE-2026-100703 Kyverno before 1.19.1 Cross-Namespace Data Access via globalcontext.Lib

Kyverno 1.16.0 through 1.19.0 registers the globalcontext.Lib CEL library in its policy environment without confining it to the policy's namespace, unlike the sibling libraries resource.Lib, http.Lib, configMap loader which are handed the policy namespace. A tenant who can create a namespaced...

EUVD-2026-87676

Kyverno 1.16.0 through 1.19.0 registers the globalcontext.Lib CEL library in its policy environment without confining it to the policy's namespace, unlike the sibling libraries resource.Lib, http.Lib, configMap loader which are handed the policy namespace. A tenant who can create a namespaced...

CVE-2026-100706: Unintended Proxy or Intermediary

kyverno before 1.19.1 fails to properly validate URL-encoded path segments in Policy apiCall urlPath, allowing namespace tenants to bypass the per-namespace clamp and create objects in other namespaces as the admission-controller ServiceAccount. Attackers can exploit this by using percent-encoded...

PT-2026-99377

Name of the Vulnerable Software and Affected Versions kyverno versions prior to 1.19.1 Description Insufficient validation of URL-encoded path segments in the Policy apiCall urlPath allows namespace tenants to bypass the per-namespace clamp. This enables the creation of objects in other namespace...

CVE-2026-98139

In the Linux kernel, the following vulnerability has been resolved: ntfs: only count successfully cleared runs when freeing clusters ntfsclusterfreefromrlnolock adds a run's length to nrfreed whenever the error bookkeeping condition is false, which includes cases where ntfsbitmapclearrun actually...

The vulnerability of the Kubernetes cluster management software lies in synchronization errors when using shared resources, allowing a malicious actor to escalate their privileges.

The vulnerability of the Kubernetes cluster management software is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow a remote attacker to gain increased privileges...

[SECURITY] [DLA 4794-1] redis security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4794-1 [email protected] https://www.debian.org/lts/security/ Chris Lamb September 24, 2026 https://wiki.debian.org/LTS -...

CVE-2026-71540

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. From 3.9.0 until 4.14.7, wazuh-clusterd in framework/wazuh/core/cluster/common.py allocates a payload buffer using the size declared in a 20-byte cluster protocol header before...

CVE-2026-71540

The Wazuh security platform is vulnerable to a memory exhaustion issue in versions 3.9.0 through 4.14.7 . The flaw exists in the wazuh-clusterd component (specifically in framework/wazuh/core/cluster/common.py), where the system allocates a payload buffer based on a 20-byte cluster protocol heade...

CVE-2026-71540 Wazuh Manager cluster header parsing allows pre-authentication memory exhaustion

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. From 3.9.0 until 4.14.7, wazuh-clusterd in framework/wazuh/core/cluster/common.py allocates a payload buffer using the size declared in a 20-byte cluster protocol header before...