CVE-2026-44935 -- CVSS 9.9 Vulnerability Briefing

CVE-2026-44935 | CVSS 9.9 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-44935 is a missing input validation vulnerability in the Helm Deployer component of SUSE Rancher Fleet, affecting the processing of valuesFrom references and enabling cross-namespace privilege abuse within multi-tenant cluster environments.

Technical Detail

The flaw exists because Rancher Fleet's Helm Deployer does not properly validate valuesFrom references when deploying Helm charts, allowing an owner of one GitRepo or Bundle resource to reference secrets or configmaps from namespaces they do not control. An attacker with limited namespace-level access can craft a malicious valuesFrom reference to read sensitive values from other tenants' namespaces, potentially including credentials, tokens, or configuration data that could be leveraged for lateral movement or privilege escalation within the cluster. The impact is unauthorized cross-namespace data access in shared Rancher Fleet deployments, with a CVSS score of 9.9 reflecting the near-complete breach of tenant isolation boundaries.

Exploitation Status

No known exploit code has been publicly identified at this time, and this CVE is not currently listed in the CISA Known Exploited Vulnerabilities catalog. The exploit maturity is assessed as no known exploit. However, the vulnerability class is straightforward to reason about for any attacker with legitimate access to a Fleet-managed cluster, and the absence of public exploit code does not substantially reduce risk for exposed deployments.

Who Is Targeting This

No specific threat actor attribution at this time. Neither confirmed nor reported threat actor associations have been identified in connection with this vulnerability.

What To Do

Organizations running SUSE Rancher Fleet should patch immediately given the critical severity rating. Fixed versions are available: 0.15.2 for the 0.15 branch, 0.14.6 for the 0.14 branch, 0.13.11 for the 0.13 branch, and 0.12.15 for the 0.12 branch. Upgrade to the appropriate fixed release as the primary remediation action. As an interim measure where patching is not immediately possible, restrict GitRepo and Bundle creation permissions to fully trusted users only, and audit existing valuesFrom configurations for references that cross namespace boundaries. Organizations operating multi-tenant Rancher Fleet deployments should treat this as a high-priority patch given the tenant isolation bypass potential. Review cluster audit logs for anomalous cross-namespace secret or configmap access patterns as a detection signal.