SUSE CVE-2026-93539

A vulnerability was discovered in Fleet's Git webhook receiver the gitjob webhook service. When a webhook secret is not configured, incoming webhook requests are accepted without verification, and processing a request can change the spec.pollingInterval field of a matching GitRepo resource in any...

EUVD-2026-88296

A vulnerability was discovered in Fleet's Git webhook receiver the gitjob webhook service. When a webhook secret is not configured, incoming webhook requests are accepted without verification, and processing a request can change the spec.pollingInterval field of a matching GitRepo resource in any...

CVE-2026-93539 Unauthenticated GitRepo Spec Mutation via Fleet Git Webhook Receiver

A vulnerability was discovered in Fleet's Git webhook receiver the gitjob webhook service. When a webhook secret is not configured, incoming webhook requests are accepted without verification, and processing a request can change the spec.pollingInterval field of a matching GitRepo resource in any...

CVE-2026-93539 Unauthenticated GitRepo Spec Mutation via Fleet Git Webhook Receiver

A vulnerability was discovered in Fleet's Git webhook receiver the gitjob webhook service. When a webhook secret is not configured, incoming webhook requests are accepted without verification, and processing a request can change the spec.pollingInterval field of a matching GitRepo resource in any...

CVE-2026-93539

A vulnerability exists in the gitjob webhook service of SUSE Rancher Fleet versions 0.16 before 0.16.2 . When a webhook secret is not configured, the receiver accepts unauthenticated requests, allowing a caller with network access and no Kubernetes credentials to mutate the spec.pollingInterval f...

CVE-2026-93539: Missing Authentication for Critical Function

A vulnerability was discovered in Fleet's Git webhook receiver the gitjob webhook service. When a webhook secret is not configured, incoming webhook requests are accepted without verification, and processing a request can change the spec.pollingInterval field of a matching GitRepo resource in any...

PT-2026-99905

Name of the Vulnerable Software and Affected Versions SUSE Rancher Fleet versions 0.16 through 0.16.1 Description The Git webhook receiver the gitjob webhook service fails to verify incoming requests when a webhook secret is not configured. This allows a remote caller with network access to the...

CVE-2026-44949

A Rancher FleetWorkspace admission path allowed side effects to occur in the Rancher webhook handler for versions 0.7.0 up to 0.7.10, 0.8.0 up to 0.8.7, 0.9.0 up to 0.9.6 and 0.10.0 up to 0.10.7. An unauthenticated attacker with network access to the in-cluster rancher-webhook service could submi...

CVE-2025-8154 HTTP Header Injection via Webhook API in Multiple WSO2 Products Allows Response Header Manipulation

In Webhook API invocations, the component accepts user-supplied input for HTTP request headers without sufficient validation or sanitization, allowing these headers to be injected into HTTP responses. By exploiting this vulnerability, a malicious actor can inject or overwrite arbitrary HTTP...

CVE-2022-39278

Istio is an open platform-independent service mesh that provides traffic management, policy enforcement, and telemetry collection. Prior to versions 1.15.2, 1.14.5, and 1.13.9, the Istio control plane, istiod, is vulnerable to a request processing error, allowing a malicious attacker that sends a...

Slack: User impersonation is possible with incoming webhooks

Using the incoming webhook service it is possible to send messages to the team from an arbitrary username. A malicious user could modify the image of the webhook service to match an existing user and then send a message with the username of an existing user. Other users would not be able to tell...