CLEANSTART-2026-WG10458 Security fix for GHSA-hrxh-6v49-42gf applied in: rancher-fleet-agent 0.15.4-r1, rancher-fleet-agent 0.15.4-r2, newrelic-infrastructure-agent 1.78.1-r2, lvm-driver 1.10.0-r1, lvm-driver 1.10.0-r2, rancher-fleet-agent 0.12.17-r1, rancher-fleet-agent 0.12.17-r2, rancher-fleet-agent 0.13.13-r0, fulcio-fips 1.5.1-r1, fluent-operator-fips 3.10.0-r2, rancher-fleet-agent 0.14.8-r1, rancher-fleet-agent 0.14.8-r2, temporal-server 1.28.4-r1, temporal-server 1.29.7-r1, litestream 0.3.14-r2, litestream 0.3.14-r3, metrics-server-fips 0.8.1-r2, trillian-fips 1.7.3-r1, distribution 3.1.1-r1, melange 0.55.0-r1, tempo-fips 3.0.2-r1, consul-fips 2.0.1-r1, crossplane-provider-sql-fips 0.15.0-r2, crossplane-provider-sql-fips 0.15.0-r3, falco-exporter 0.8.7-r2, k8sgpt-operator 0.2.27-r1, kubernetes-csi-external-resizer-fips 2.2.1-r1, promxy 0.0.96-r3, promxy 0.0.96-r2, cadvisor-fips 0.60.3-r1, consul-k8s-fips 1.8.14-r1, distribution-fips 3.1.1-r1, kaniko 1.24.0-r2, prometheus-adapter 0.12.0-r1, yunikorn-k8shim-fips 1.8.0-r2, multus-cni-fips 4.3.0-r1

GHSA-hrxh-6v49-42gf affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-AW95345 Security fix for GHSA-vh4v-2xq2-g5cg applied in: rancher-fleet-agent 0.15.4-r1, rancher-fleet-agent 0.15.4-r2, rancher-fleet-agent 0.12.17-r1, rancher-fleet-agent 0.12.17-r2, rancher-fleet-agent 0.13.13-r0, rancher-agent 2.11.15-r1, rancher-agent 2.12.11-r1, rancher-agent 2.12.11-r2, rancher-fleet-agent 0.14.8-r2, rancher-fleet-agent 0.14.8-r1, consul-k8s-fips 1.8.14-r1, tigera-operator-fips 1.40.13-r1

GHSA-vh4v-2xq2-g5cg affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-GS98913 Helm is a package manager for Charts for Kubernetes

Security vulnerability affects the rancher-fleet-agent package. Helm is a package manager for Charts for Kubernetes...

CLEANSTART-2026-OJ05849 Security fix for GHSA-259r-337f-4rfw applied in: loki 3.7.1-r2, keda 2.20.2-r0, knative-serving 1.21.3-r0, velero 1.16.2-r15, velero 1.16.2-r8, prometheus 3.5.3-r12, prometheus 3.5.3-r8, temporal-server 1.30.6-r1, temporal-server 1.30.6-r2, temporal-server 1.30.8-r1, temporal-server-fips 1.31.4-r1, mongodb 8.1.3-r2, weaviate-fips 1.36.23-r2, kubernetes-event-exporter 1.4-r0, rancher-fleet-agent 0.13.16-r1, thanos 0.40.1-r3, thanos 0.41.0-r2, prometheus 3.5.3-r9, thanos 0.39.2-r4, cadvisor 0.55.1-r3, step-issuer 0.10.2-r3

GHSA-259r-337f-4rfw affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-XI67538 go-git is an extensible git implementation library written in pure Go

Security vulnerability affects the rancher-fleet-agent package. go-git is an extensible git implementation library written in pure Go...

CLEANSTART-2026-UH94830 go-git is an extensible git implementation library written in pure Go

Security vulnerability affects the rancher-fleet-agent package. go-git is an extensible git implementation library written in pure Go...

CLEANSTART-2026-SU12869 Helm is a package manager for Charts for Kubernetes

Security vulnerability affects the rancher-fleet-agent package. Helm is a package manager for Charts for Kubernetes...

CLEANSTART-2026-LW61717 Security fix for GHSA-vh4v-2xq2-g5cg applied in: argo-cd-fips 3.3.7-r5, argo-cd-fips 3.3.7-r6, rancher-fleet-agent 0.13.16-r1

GHSA-vh4v-2xq2-g5cg affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-WH73146 Security fix for GHSA-8xwf-rjm4-xvhv applied in: argo-cd-fips 3.3.7-r5, argo-cd-fips 3.3.7-r6, rancher-fleet-agent 0.13.16-r1

GHSA-8xwf-rjm4-xvhv affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-KH33677 containerd is an open-source container runtime

Security vulnerability affects the rancher-fleet-agent package. containerd is an open-source container runtime...

CLEANSTART-2026-YC47905 containerd is an open-source container runtime

Security vulnerability affects the rancher-fleet-agent package. containerd is an open-source container runtime...

CLEANSTART-2026-NU87988 containerd is an open-source container runtime

Security vulnerability affects the rancher-fleet-agent package. containerd is an open-source container runtime...

CLEANSTART-2026-TY82458 containerd is an open-source container runtime

Security vulnerability affects the rancher-fleet-agent package. containerd is an open-source container runtime...

CLEANSTART-2026-OU23075 containerd is an open-source container runtime

Security vulnerability affects the rancher-fleet-agent package. containerd is an open-source container runtime...

CLEANSTART-2026-OJ18317 containerd is an open-source container runtime

Security vulnerability affects the rancher-fleet-agent package. containerd is an open-source container runtime...

CLEANSTART-2026-SN22450 containerd is an open-source container runtime

Security vulnerability affects the rancher-fleet-agent package. containerd is an open-source container runtime...

CLEANSTART-2026-FE20751 containerd is an open-source container runtime

Security vulnerability affects the rancher-fleet-agent package. containerd is an open-source container runtime...

CVE-2026-88808

A vulnerability has been identified within Rancher Manager where the Fleet agent wrote resources to downstream clusters using its own cluster-admin credentials instead of the ServiceAccount pinned to the deployment. It affects multi-tenancy environments where different tenants share the same...

CVE-2026-88808

A vulnerability has been identified within Rancher Manager where the Fleet agent wrote resources to downstream clusters using its own cluster-admin credentials instead of the ServiceAccount pinned to the deployment. It affects multi-tenancy environments where different tenants share the same...

EUVD-2026-88335

A vulnerability has been identified within Rancher Manager where the Fleet agent wrote resources to downstream clusters using its own cluster-admin credentials instead of the ServiceAccount pinned to the deployment. It affects multi-tenancy environments where different tenants share the same...