CVE-2026-41050

Description

Fleet's Helm deployer did not fully apply ServiceAccount impersonation in two code paths, allowing a tenant with git push access to a Fleet-monitored repository to read secrets from any namespace on every downstream cluster targeted by their `GitRepo`.

CVSS Metrics

• v3.1•CRITICAL•Score: 9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

EPSS Trends

Current EPSS score: 0.04%• Percentile: 12%

Techniques & Countermeasures

• CWE-863•Incorrect Authorization

  The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Affected Systems

• github.com/rancher•fleet

  ≥ 0.15.0, < 0.15.1 | ≥ 0.14.0, < 0.14.5 | ≥ 0.13.0, < 0.13.10 | ≥ 0.12.0, < 0.12.14 | ≥ 0.11.0, < 0.11.13

• suse•rancher

  ≥ 0.15.0, < 0.15.1 | ≥ 0.14.0, < 0.14.5 | ≥ 0.13.0, < 0.13.10 | ≥ 0.12.0, < 0.12.14 | ≥ 0.11.0, < 0.11.13

References (4)

• https://github.com/rancher/fleet/security/advisories/GHSA-765j-qfrp-hm3j
• https://github.com/rancher/fleet
• https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-41050
• https://github.com/advisories/GHSA-765j-qfrp-hm3j