OPENSUSE-SU-2026:11186-1 helm-4.2.2-2.1 on GA media

These are all security issues fixed in the helm-4.2.2-2.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-44935

Missing validation of "valuesFrom" references in Helm Deployer of SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.15 could be used by owners of one tenant to access fleet credentials of other tenants...

CVE-2026-44935

The vulnerability (CVE-2026-44935) affects SUSE Rancher Fleet’s Helm Deployer where missing validation of valuesFrom references enables cross-tenant access to fleet credentials stored in secrets/config maps on downstream clusters. Affected versions include Fleet 0.15.x before 0.15.2, 0.14.x befor...

CVE-2026-44935

Missing validation of "valuesFrom" references in Helm Deployer of SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.15 could be used by owners of one tenant to access fleet credentials of other tenants...

CVE-2026-44935 Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm Deployer

Missing validation of "valuesFrom" references in Helm Deployer of SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.15 could be used by owners of one tenant to access fleet credentials of other tenants...

CVE-2026-44935 Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm Deployer

Missing validation of "valuesFrom" references in Helm Deployer of SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.15 could be used by owners of one tenant to access fleet credentials of other tenants...

CVE-2026-48978 vulnerabilities

Vulnerabilities for packages: drone, k8sgpt, ocm-cli, kgateway-fips, k8ssandra-client, teleport, trivy-operator-fips, falcoctl, tw, kubescape-operator, kyverno-notation-aws-fips, tigera-operator, harvester, kube-arangodb, steampipe, trivy-operator, oras, trivy, helm-operator-fips, cloudbeat,...

GHSA-8XWF-RJM4-XVHV vulnerabilities

Vulnerabilities for packages: drone, ocm-cli, kgateway-fips, k8ssandra-client, teleport, trivy-operator-fips, falcoctl, tw, kubescape-operator, kyverno-notation-aws-fips, tigera-operator, kube-arangodb, steampipe, trivy-operator, oras, trivy, helm-operator-fips, cloudbeat, gatekeeper, kubescape,...

CVE-2026-50162 vulnerabilities

Vulnerabilities for packages: drone, ocm-cli, kgateway-fips, k8ssandra-client, teleport, trivy-operator-fips, falcoctl, tw, kubescape-operator, kyverno-notation-aws-fips, tigera-operator, kube-arangodb, steampipe, trivy-operator, oras, trivy, helm-operator-fips, cloudbeat, gatekeeper, kubescape,...

GHSA-VH4V-2XQ2-G5CG vulnerabilities

Vulnerabilities for packages: drone, ocm-cli, kgateway-fips, k8ssandra-client, teleport, trivy-operator-fips, falcoctl, tw, kubescape-operator, kyverno-notation-aws-fips, tigera-operator, kube-arangodb, steampipe, trivy-operator, oras, trivy, helm-operator-fips, cloudbeat, gatekeeper, kubescape,...

GHSA-XF85-363P-868W vulnerabilities

Vulnerabilities for packages: drone, k8sgpt, ocm-cli, kgateway-fips, k8ssandra-client, teleport, trivy-operator-fips, falcoctl, tw, kubescape-operator, kyverno-notation-aws-fips, tigera-operator, harvester, kube-arangodb, steampipe, trivy-operator, oras, trivy, helm-operator-fips, cloudbeat,...

CVE-2026-50151 vulnerabilities

Vulnerabilities for packages: drone, ocm-cli, kgateway-fips, k8ssandra-client, teleport, trivy-operator-fips, falcoctl, tw, kubescape-operator, kyverno-notation-aws-fips, tigera-operator, kube-arangodb, steampipe, trivy-operator, oras, trivy, helm-operator-fips, cloudbeat, gatekeeper, kubescape,...

GHSA-JXPM-75MH-9FP7 vulnerabilities

Vulnerabilities for packages: drone, ocm-cli, kgateway-fips, k8ssandra-client, teleport, trivy-operator-fips, falcoctl, tw, kubescape-operator, kyverno-notation-aws-fips, tigera-operator, kube-arangodb, steampipe, trivy-operator, oras, trivy, helm-operator-fips, cloudbeat, gatekeeper, kubescape,...

GHSA-XR65-5CPM-G36X Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm Deployer

Impact A vulnerability in Fleet for Rancher Manager affects multi-tenancy environments where different tenants share the same downstream clusters e.g., different privileged or untrusted teams inside the same organization. On unpatched versions, tenants could bypass restrictions to access any conf...

Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm Deployer

Impact A vulnerability in Fleet for Rancher Manager affects multi-tenancy environments where different tenants share the same downstream clusters e.g., different privileged or untrusted teams inside the same organization. On unpatched versions, tenants could bypass restrictions to access any conf...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the helm.repo process when the helmRepoURLRegex field is not set on a GitRepo resource. An attacker with git push access to a monitored repository can cause the system to forward Helm authentication...

GHSA-HX4V-CXPF-VH8M Rancher Fleet has SSRF in Bundle Reader via Unvalidated Helm Repository URL in fleet.yaml

Impact A vulnerability has been identified in Fleet when the helmRepoURLRegex field isn't set on a GitRepo resource. Fleet's bundle reader forwards Helm authentication credentials BasicAuth to any URL specified in the helm.repo field of a fleet.yaml file. An attacker with git push access to a...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the helm.repo process when the helmRepoURLRegex field is not set on a GitRepo resource. An attacker with git push access to a monitored repository can cause the system to forward Helm authentication...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the helm.repo process when the helmRepoURLRegex field is not set on a GitRepo resource. An attacker with git push access to a monitored repository can cause the system to forward Helm authentication...

Rancher Fleet has SSRF in Bundle Reader via Unvalidated Helm Repository URL in fleet.yaml

Impact A vulnerability has been identified in Fleet when the helmRepoURLRegex field isn't set on a GitRepo resource. Fleet's bundle reader forwards Helm authentication credentials BasicAuth to any URL specified in the helm.repo field of a fleet.yaml file. An attacker with git push access to a...