GO-2026-5566 vulnerabilities

Vulnerabilities for packages: gitlab-operator, cilium-cli, helm-diff-fips, flux, flux-source-controller-fips, rancher-fleet-fips, zarf-fips, cert-manager-cmctl-fips, helm-push, kuma, kots, helm-diff, flux-fips, rancher-fleet, cert-manager-cmctl, flux-source-controller, gitlab-operator-fips, zarf...

GO-2026-5666 vulnerabilities

Vulnerabilities for packages: gitlab-operator, cilium-cli, helm-diff-fips, flux, flux-source-controller-fips, rancher-fleet-fips, zarf-fips, cert-manager-cmctl-fips, helm-push, kuma, kots, helm-diff, flux-fips, rancher-fleet, cert-manager-cmctl, flux-source-controller, gitlab-operator-fips, zarf...

GO-2026-5882 vulnerabilities

Vulnerabilities for packages: ocm-cli, envoy-gateway, gatekeeper, headlamp, cluster-api-helm-controller, tw, xeol, trivy-fips, helm-operator-fips, manifest-tool, consul-k8s, kubescape-operator-fips, argocd-image-updater-fips, consul-k8s-fips, kube-mgmt, rancher-agent, ocm-cli-fips, xeol-fips,...

GO-2025-3922 vulnerabilities

Vulnerabilities for packages: vcluster, kubescape-operator, envoy-gateway, zarf, trufflehog, filebrowser, nuclei, trivy, trivy-operator, terraform, gptscript, opentofu, terragrunt, guac, xeol, undock, steampipe, gitness, tflint, nsc, podman, gitleaks, k9s, grafana-alloy, zot, rancher-fleet...

GO-2026-5566 vulnerabilities

Vulnerabilities for packages: cilium-cli, helm-push, zarf, cert-manager-cmctl, flux-source-controller, rancher-fleet, kots, flux, kuma...

GO-2026-5666 vulnerabilities

Vulnerabilities for packages: cilium-cli, helm-push, zarf, cert-manager-cmctl, flux-source-controller, rancher-fleet, kots, flux, kuma...

GO-2025-3802 vulnerabilities

Vulnerabilities for packages: envoy-gateway, rancher-helm, zarf, tw, flux-source-controller, pluto, kots, cluster-api-helm-controller, trivy, flux-helm-controller, kargo, chart-testing, helm-push, cerbos, k8sgpt, eksctl, istio, helm-operator, cert-manager-cmctl, chartmuseum, k9s, helm-docs,...

GO-2026-4910 vulnerabilities

Vulnerabilities for packages: gitsign, pulumi-language-java, dagger, zarf, trufflehog, gitea, argo-workflows, flux-source-controller, nuclei, kots, melange, osv-scanner, kubescape, scorecard, apko, gitlab-runner, gptscript, syft, gomplate, pulumi-language-dotnet, argo-events, crossplane, kargo,...

GO-2026-5490 vulnerabilities

Vulnerabilities for packages: terragrunt, telegraf, teleport, gitaly, external-secrets-operator, argo-cd, cerbos, rancher-fleet, syft, scorecard, flux, rclone...

GO-2026-5597 vulnerabilities

Vulnerabilities for packages: terragrunt, telegraf, gitaly, external-secrets-operator, argo-cd, cerbos, rancher-fleet, syft, scorecard, teleport, rclone...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: pulumi-language-java, vcluster, kubernetes-csi-external-provisioner, govulncheck, sftpgo-plugin-eventstore, ctop, trufflehog, datadog-agent, crossplane-provider-aws-cloudfront, jaeger-operator, kots, nri-haproxy, kubescape, spire-server, docker-cli-buildx,...

GO-2026-5874 Rancher Fleet has Unauthenticated Webhook: Regex Injection via Unsanitized Repository URL Components in github.com/rancher/fleet

Rancher Fleet has Unauthenticated Webhook: Regex Injection via Unsanitized Repository URL Components in github.com/rancher/fleet...

GO-2026-5873 Rancher Fleet has SSRF in Bundle Reader via Unvalidated Helm Repository URL in fleet.yaml in github.com/rancher/fleet

Rancher Fleet has SSRF in Bundle Reader via Unvalidated Helm Repository URL in fleet.yaml in github.com/rancher/fleet...

CVE-2026-44937

Potential forgery of webhook requests when using a unauthenticated webhook in SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.5 could be used by remote attackers to cause a denial of service or a downgrade attack on other repositories on the...

CVE-2026-44937

Summary: An unauthenticated webhook vulnerability in SUSE Rancher Fleet (versions prior to 0.15.2, 0.14 prior to 0.14.6, 0.13 prior to 0.13.11, 0.12 prior to 0.12.15) allows forging webhook requests via regex-based injection from unsanitized repository URL components, potentially enabling DoS or ...

CVE-2026-44937

Potential forgery of webhook requests when using a unauthenticated webhook in SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.5 could be used by remote attackers to cause a denial of service or a downgrade attack on other repositories on the...

EUVD-2026-41867

Potential forgery of webhook requests when using a unauthenticated webhook in SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.5 could be used by remote attackers to cause a denial of service or a downgrade attack on other repositories on the...

CVE-2026-44937 SUSE Rancher Fleet had an Unauthenticated Webhook: Regex Injection via Unsanitized Repository URL Components

Potential forgery of webhook requests when using a unauthenticated webhook in SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.5 could be used by remote attackers to cause a denial of service or a downgrade attack on other repositories on the...

CVE-2026-44936

CVE-2026-44936 describes an SSRF risk in SUSE Rancher Fleet’s bundle reader when the helmRepoURLRegex field is not set on a GitRepo. The vulnerability allows forwarding Helm authentication credentials (BasicAuth) to any URL specified in the fleet.yaml helm.repo field, potentially leaking admin cr...

CVE-2026-44936 Rancher Fleet SSRF in Bundle Reader via Unvalidated Helm Repository URL in fleet.yaml

Missing filtering when the helmRepoURLRegex field isn't set on a GitRepo resource in SUSE Rancher Fleet's bundle reader in 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.15 forwards Helm authentication credentials BasicAuth to any URL specified in the helm.repo...