critical9.9
CVE-2026-41050
Fleet's Helm deployer did not fully apply ServiceAccount impersonation in two code paths, allowing a tenant with git push access to a Fleet-monitored repositor…
Impact
Fleet's Helm deployer did not fully apply ServiceAccount impersonation in two code paths, allowing a tenant with git push access to a Fleet-monitored repository to read secrets from any namespace on every downstream cluster targeted by their `GitRepo`.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/rancher/fleet | >= 0.15.0, < 0.15.1 | 0.15.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Suse | Rancher Fleet | from 0.11.0 before 0.11.13 from 0.12.0 before 0.12.14 from 0.13.0 before 0.13.10 from 0.14.0 before 0.14.5 from 0.15.0 before 0.15.1 |