CVE-2026-94290

In SUSE Rancher Fleet , an attacker can achieve cluster-admin privileges on the management cluster due to insufficient restrictions on kubeconfig secrets referenced by a Fleet Cluster object . Specifically, the controller fails to limit which secrets an ordinary user can reference; if a user asso...

CVE-2026-94290 Privilege escalation to cluster-admin on the Rancher local cluster through Fleet's agent management controller

SUSE Rancher Fleet clusters reference a kubeconfig secret that the controller uses to install and manage a Fleet agent on the target cluster. The controller did not sufficiently restrict which kubeconfig secrets a Fleet Cluster object was allowed to reference. As a result, a Fleet cluster defined...

CVE-2026-94290 Privilege escalation to cluster-admin on the Rancher local cluster through Fleet's agent management controller

SUSE Rancher Fleet clusters reference a kubeconfig secret that the controller uses to install and manage a Fleet agent on the target cluster. The controller did not sufficiently restrict which kubeconfig secrets a Fleet Cluster object was allowed to reference. As a result, a Fleet cluster defined...