CVE-2026-41050 -- CVSS 9.9 Vulnerability Briefing

CVE-2026-41050 | CVSS 9.9 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-41050 is a privilege escalation and secret disclosure vulnerability in Fleet's Helm deployer component, where incomplete enforcement of ServiceAccount impersonation allows unauthorized cross-namespace secret access within Kubernetes environments managed by Fleet.

Technical Detail

Fleet's Helm deployer failed to fully apply ServiceAccount impersonation controls across two distinct code paths, meaning that the intended tenant-level permission boundaries were not consistently enforced during Helm deployments. An attacker with git push access to a Fleet-monitored repository can exploit this flaw to trigger the affected code paths and read Kubernetes secrets from namespaces outside their authorized scope, including potentially privileged namespaces such as kube-system. The impact is unauthorized secret disclosure at cluster scope, which in practice can lead to full cluster compromise if administrative credentials or service account tokens are stored as Kubernetes secrets, as is common in multi-tenant Fleet deployments.

Exploitation Status

No known exploit code has been identified at this time, and this CVE is not currently listed in the CISA Known Exploited Vulnerabilities catalog. The exploit maturity is assessed as no known exploit, meaning no public proof-of-concept or confirmed in-the-wild exploitation has been observed as of May 20, 2026. However, the attack requirement of git push access is a relatively low bar in environments with shared repository access, which reduces the practical difficulty of exploitation once an attacker has established that foothold.

Who Is Targeting This

No specific threat actor attribution at this time. No campaigns, threat groups, or targeted sectors have been associated with this vulnerability in available intelligence. Given the nature of the flaw, organizations running multi-tenant Kubernetes environments with Fleet-managed GitOps workflows represent the most relevant exposure surface, but no targeted activity has been confirmed.

What To Do

Apply the vendor-supplied patch for Fleet's Helm deployer as soon as it becomes available, prioritizing environments where multiple tenants or external contributors have git push access to Fleet-monitored repositories. As an interim measure, restrict git push permissions to the minimum necessary set of trusted users and audit existing repository access controls to identify any accounts that should not have write access. Review Kubernetes RBAC configurations to ensure that ServiceAccount permissions are scoped as narrowly as possible, and audit secrets stored in cluster namespaces to assess potential exposure. Enable audit logging on the Kubernetes API server to detect anomalous cross-namespace secret read operations, which may serve as an indicator of exploitation attempts. Given the CVSS score of 9.9, this should be treated as a high-priority remediation item even in the absence of confirmed active exploitation.