1852 matches found
CVE-2026-44936 Rancher Fleet SSRF in Bundle Reader via Unvalidated Helm Repository URL in fleet.yaml
Missing filtering when the helmRepoURLRegex field isn't set on a GitRepo resource in SUSE Rancher Fleet's bundle reader in 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.15 forwards Helm authentication credentials BasicAuth to any URL specified in the helm.repo...
CVE-2026-44936 Rancher Fleet SSRF in Bundle Reader via Unvalidated Helm Repository URL in fleet.yaml
Missing filtering when the helmRepoURLRegex field isn't set on a GitRepo resource in SUSE Rancher Fleet's bundle reader in 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.15 forwards Helm authentication credentials BasicAuth to any URL specified in the helm.repo...
OPENSUSE-SU-2026:11186-1 helm-4.2.2-2.1 on GA media
These are all security issues fixed in the helm-4.2.2-2.1 package on the GA media of openSUSE Tumbleweed...
CVE-2026-44935
Missing validation of "valuesFrom" references in Helm Deployer of SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.15 could be used by owners of one tenant to access fleet credentials of other tenants...
EUVD-2026-41408
Missing validation of "valuesFrom" references in Helm Deployer of SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.15 could be used by owners of one tenant to access fleet credentials of other tenants...
CVE-2026-44935 Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm Deployer
Missing validation of "valuesFrom" references in Helm Deployer of SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.15 could be used by owners of one tenant to access fleet credentials of other tenants...
CVE-2026-44935
Missing validation of "valuesFrom" references in Helm Deployer of SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.15 could be used by owners of one tenant to access fleet credentials of other tenants...
CVE-2026-44935 Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm Deployer
Missing validation of "valuesFrom" references in Helm Deployer of SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.15 could be used by owners of one tenant to access fleet credentials of other tenants...
CVE-2026-44935
The vulnerability (CVE-2026-44935) affects SUSE Rancher Fleet’s Helm Deployer where missing validation of valuesFrom references enables cross-tenant access to fleet credentials stored in secrets/config maps on downstream clusters. Affected versions include Fleet 0.15.x before 0.15.2, 0.14.x befor...
CVE-2026-44935 Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm Deployer
Missing validation of "valuesFrom" references in Helm Deployer of SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.15 could be used by owners of one tenant to access fleet credentials of other tenants...
CVE-2026-48978 vulnerabilities
Vulnerabilities for packages: jfrog-cli, cloudbeat-fips, conftest, ocm-cli, kgateway-fips, vcluster, manifest-tool, maru, teleport, falcoctl-fips, gitness, kubescape-server-fips, argocd-image-updater, gogatekeeper, envoy-gateway, kubescape-server, opentofu-fips, kargo, eksctl, helm-exporter,...
GHSA-8XWF-RJM4-XVHV vulnerabilities
Vulnerabilities for packages: jfrog-cli, cloudbeat-fips, conftest, ocm-cli, kgateway-fips, vcluster, manifest-tool, maru, teleport, falcoctl-fips, gitness, kubescape-server-fips, argocd-image-updater, gogatekeeper, envoy-gateway, kubescape-server, opentofu-fips, kargo, eksctl, helm-exporter,...
GHSA-XF85-363P-868W vulnerabilities
Vulnerabilities for packages: jfrog-cli, cloudbeat-fips, conftest, ocm-cli, kgateway-fips, vcluster, manifest-tool, maru, teleport, falcoctl-fips, gitness, kubescape-server-fips, argocd-image-updater, gogatekeeper, envoy-gateway, kubescape-server, opentofu-fips, kargo, eksctl, helm-exporter,...
GHSA-VH4V-2XQ2-G5CG vulnerabilities
Vulnerabilities for packages: jfrog-cli, cloudbeat-fips, conftest, ocm-cli, kgateway-fips, vcluster, manifest-tool, maru, teleport, falcoctl-fips, gitness, kubescape-server-fips, argocd-image-updater, gogatekeeper, envoy-gateway, kubescape-server, opentofu-fips, kargo, eksctl, helm-exporter,...
CVE-2026-50162 vulnerabilities
Vulnerabilities for packages: jfrog-cli, cloudbeat-fips, conftest, ocm-cli, kgateway-fips, vcluster, manifest-tool, maru, teleport, falcoctl-fips, gitness, kubescape-server-fips, argocd-image-updater, gogatekeeper, envoy-gateway, kubescape-server, opentofu-fips, kargo, eksctl, helm-exporter,...
GHSA-JXPM-75MH-9FP7 vulnerabilities
Vulnerabilities for packages: jfrog-cli, cloudbeat-fips, conftest, ocm-cli, kgateway-fips, vcluster, manifest-tool, maru, teleport, falcoctl-fips, gitness, kubescape-server-fips, argocd-image-updater, gogatekeeper, envoy-gateway, kubescape-server, opentofu-fips, kargo, eksctl, helm-exporter,...
CVE-2026-50151 vulnerabilities
Vulnerabilities for packages: jfrog-cli, cloudbeat-fips, conftest, ocm-cli, kgateway-fips, vcluster, manifest-tool, maru, teleport, falcoctl-fips, gitness, kubescape-server-fips, argocd-image-updater, gogatekeeper, envoy-gateway, kubescape-server, opentofu-fips, kargo, eksctl, helm-exporter,...
CVE-2026-44935: Improper Validation of Specified Type of Input
Missing validation of "valuesFrom" references in Helm Deployer of SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.15 could be used by owners of one tenant to access fleet credentials of other tenants...
GHSA-XR65-5CPM-G36X Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm Deployer
Impact A vulnerability in Fleet for Rancher Manager affects multi-tenancy environments where different tenants share the same downstream clusters e.g., different privileged or untrusted teams inside the same organization. On unpatched versions, tenants could bypass restrictions to access any conf...
Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm Deployer
Impact A vulnerability in Fleet for Rancher Manager affects multi-tenancy environments where different tenants share the same downstream clusters e.g., different privileged or untrusted teams inside the same organization. On unpatched versions, tenants could bypass restrictions to access any conf...