{"schemaVersion":3,"id":"CVE-2026-93537","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"A user who can supply bundle content to a repository referenced by a GitRepo resource, for example through Git push access, or through permission to create or modify a GitRepo, can cause SUSE Rancher Fleet to read files from the filesystem of the environment that processes the bundle and include their contents in the generated Bundle resource. This can expose configuration or credential material that the user has no Kubernetes RBAC permission to read, including Helm registry credentials made available to the bundle-processing job when per-path Helm credentials are configured.\nThis affects Fleet 0.16 before 0.16.2, 0.15 before 0.15.7, 0.14 before 0.14.11, 0.13 before 0.13.16, 0.12 before 0.12.20 and potentially older unsupported versions.","dates":{"published":"2026-09-28T13:29:10.263Z","modified":"2026-09-28T17:54:22.754Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":6.5,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":6.5,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":6.5,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00308,"percentile":0.2225,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[{"date":"2026-09-29T00:00:00.000Z","score":0.00302,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00302,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00302,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00302,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00302,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00302,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00302,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00302,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00302,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00308,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00308,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00308,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00308,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00308,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00308,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00308,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00308,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00308,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00308,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00308,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00308,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00308,"percentile":0.2225}],"last30":[{"date":"2026-09-29T00:00:00.000Z","score":0.00302,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00302,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00302,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00302,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00302,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00302,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00302,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00302,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00302,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00308,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00308,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00308,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00308,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00308,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00308,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00308,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00308,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00308,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00308,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00308,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00308,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00308,"percentile":0.2225}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-23","name":"Relative Path Traversal","description":"The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as \"..\" that can resolve to a location that is outside of that directory.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/23.html"}],"affected":[{"vendor":"suse","product":"rancher","name":"rancher","label":"rancher","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 0.16.0, < 0.16.2","noFixRecorded":false,"fixedIn":null},{"text":"≥ 0.15.0, < 0.15.7","noFixRecorded":false,"fixedIn":null},{"text":"≥ 0.14.0, < 0.14.11","noFixRecorded":false,"fixedIn":null},{"text":"≥ 0.13.0, < 0.13.16","noFixRecorded":false,"fixedIn":null},{"text":"≥ 0.12.0, < 0.12.20","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 0.16.0, < 0.16.2 | ≥ 0.15.0, < 0.15.7 | ≥ 0.14.0, < 0.14.11 | ≥ 0.13.0, < 0.13.16 | ≥ 0.12.0, < 0.12.20","eol":{"isEol":null,"eolDate":null,"matchMethod":"cpe","cycle":null,"product":{"name":"rancher","label":"Rancher","category":"server-app"}},"hubHref":"/vendor/suse/rancher"},{"vendor":"suse","product":"rancher_fleet","name":"rancher fleet","label":"rancher_fleet","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 0.12.0, < 0.12.20","noFixRecorded":false,"fixedIn":null},{"text":"≥ 0.13.0, < 0.13.16","noFixRecorded":false,"fixedIn":null},{"text":"≥ 0.14.0, < 0.14.11","noFixRecorded":false,"fixedIn":null},{"text":"≥ 0.15.0, < 0.15.7","noFixRecorded":false,"fixedIn":null},{"text":"≥ 0.16.0, < 0.16.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 0.12.0, < 0.12.20 | ≥ 0.13.0, < 0.13.16 | ≥ 0.14.0, < 0.14.11 | ≥ 0.15.0, < 0.15.7 | ≥ 0.16.0, < 0.16.2","eol":null,"hubHref":"/vendor/suse/rancher_fleet"}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/rancher/fleet/security/advisories/GHSA-wpfm-r97v-3j4h","label":"github.com/rancher/fleet/security/advisories/GHSA-wpfm-r97v-3j4h","hostname":"github.com","tags":["Vendor Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-09-28T13:29:10.263Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-09-28T17:54:22.754Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":26,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T00:32:55.110Z","stale":false,"partial":false}}