high8.8
CVE-2026-44938
A vulnerability has been identified in Fleet's agent-side deployer, which did not filter security-sensitive keys from namespaceLabels in fleet.yaml (or BundleD…
Impact
A vulnerability has been identified in Fleet's agent-side deployer, which did not filter security-sensitive keys from namespaceLabels in fleet.yaml (or BundleDeployment.spec.options.namespaceLabels) when applying them to the target namespace. An attacker with git push access to a Fleet-monitored repository could overwrite Pod Security Standards (PSS) enforcement labels on a target namespace. This allows the attacker to weaken admission controls and deploy workloads that PSS policies would otherwise block.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/rancher/fleet | >= 0.15.0, < 0.15.2 | 0.15.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Suse | Rancher Fleet | from 0.12.0 before 0.12.15 from 0.13.0 before 0.13.11 from 0.14.0 before 0.14.6 from 0.15.0 before 0.15.2 |