Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/rancher/fleet

7 known vulnerabilities (2 critical, 3 high, 2 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
7 · 2 critical, 3 high, 2 medium
Registry
pkg.go.dev

Advisories 7

  • CVE-2025-23390Medium 6.3

    Fleet doesn’t validate a server’s certificate when connecting through SSH

    Affected: from 0.9.0-rc.1, fixed in 0.10.12; from 0.11.0, fixed in 0.11.7; from 0.12.0, fixed in 0.12.2; from 0.9.0-rc.1, fixed in 0.10.12; from 0.11.0, fixed in 0.11.7; from 0.12.0, fixed in 0.12.2.

  • Fleet has PSS Bypass through addLabelsFromOptions in Fleet Agent

    Affected: from 0.12.0, fixed in 0.12.15; from 0.13.0, fixed in 0.13.11; from 0.14.0, fixed in 0.14.6; from 0.15.0, fixed in 0.15.2; from 0.15.0, fixed in 0.15.2; from 0.14.0, fixed in 0.14.6; from 0.13.0, fixed in 0.13.11; from 0.12.0, fixed in 0.12.15.

  • SUSE Rancher Fleet had an Unauthenticated Webhook: Regex Injection via Unsanitized Repository URL Components

    Affected: from 0.15.0, fixed in 0.15.2; from 0.14.0, fixed in 0.14.6; from 0.13.0, fixed in 0.13.11; from 0.12.0, fixed in 0.12.15; from 0.12.0, fixed in 0.12.15; from 0.13.0, fixed in 0.13.11; from 0.14.0, fixed in 0.14.6; from 0.15.0, fixed in 0.15.2.

  • CVE-2026-44936Medium 5.0

    Rancher Fleet SSRF in Bundle Reader via Unvalidated Helm Repository URL in fleet.yaml

    Affected: from 0.15.0, fixed in 0.15.2; from 0.14.0, fixed in 0.14.6; from 0.13.0, fixed in 0.13.11; from 0.12.0, fixed in 0.12.15; from 0.12.0, fixed in 0.12.15; from 0.13.0, fixed in 0.13.11; from 0.14.0, fixed in 0.14.6; from 0.15.0, fixed in 0.15.2.

  • CVE-2026-44935Critical 9.9

    Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm Deployer

    Affected: from 0.12.0, fixed in 0.12.15; from 0.13.0, fixed in 0.13.11; from 0.14.0, fixed in 0.14.6; from 0.15.0, fixed in 0.15.2; from 0.15.0, fixed in 0.15.2; from 0.14.0, fixed in 0.14.6; from 0.13.0, fixed in 0.13.11; from 0.12.0, fixed in 0.12.15.

  • CVE-2026-41050Critical 9.9

    Helm impersonation bypass of `RESTClientGetter` retains `cluster-admin` during template rendering

    Affected: from 0.15.0, fixed in 0.15.1; from 0.14.0, fixed in 0.14.5; from 0.13.0, fixed in 0.13.10; from 0.12.0, fixed in 0.12.14; from 0.11.0, fixed in 0.11.13; from 0.11.0, fixed in 0.11.13; from 0.12.0, fixed in 0.12.14; from 0.13.0, fixed in 0.13.10; from 0.14.0, fixed in 0.14.5; from 0.15.0, fixed in 0.15.1.

  • Rancher Fleet Helm Values are stored inside BundleDeployment in plain text

    Affected: from 0.11.0, fixed in 0.11.10; from 0.12.0, fixed in 0.12.6; from 0.13.0, fixed in 0.13.1-0.20250806151509-088bcbea7edb; from 0.13.0, fixed in 0.13.1-0.20250806151509-088bcbea7edb; from 0.12.0, fixed in 0.12.6; from 0.11.0, fixed in 0.11.10.