CVE-2026-44936

Missing filtering when the helmRepoURLRegex field isn't set on a GitRepo resource in SUSE Rancher Fleet's bundle reader in 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.15 forwards Helm authentication credentials (BasicAuth) to any URL specified in the helm.repo field of a fleet.yaml file, allowing attackers able to push to fleet monitored git repos to leak helm access credentials.

CVSS v3 5.0 MEDIUM

5.0^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.1 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/advisories/GHSA-hx4v-cxpf-vh8m	Exploit Third Party Advisory Mitigation

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:suse:rancher_fleet::::::::
	cpe:2.3:a:suse:rancher_fleet::::::::
	cpe:2.3:a:suse:rancher_fleet::::::::
	cpe:2.3:a:suse:rancher_fleet::::::::

History

25 Oct 2026, 15:10

Type	Values Removed	Values Added
Summary		(es) Falta de filtrado cuando el campo helmRepoURLRegex no está configurado en un recurso GitRepo en el lector de paquetes de SUSE Rancher Fleet en 0.15 antes de 0.15.2, 0.14 antes de 0.14.6, 0.13 antes de 0.13.11 y 0.12 antes de 0.12.15, reenvía credenciales de autenticación de Helm (BasicAuth) a cualquier URL especificada en el campo helm.repo de un archivo fleet.yaml, permitiendo a los atacantes capaces de enviar a repositorios Git monitoreados por Fleet filtrar credenciales de acceso de Helm.

Information

Published : 2026-07-06 11:16

Updated : 2026-10-25 15:10

NVD link : CVE-2026-44936

Mitre link : CVE-2026-44936

CVE.ORG link : CVE-2026-44936

JSON object : View

Products Affected

suse

rancher_fleet

CWE

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2026-44936", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44936", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-06T12:47:38.527371Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "meissner@suse.de", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.0, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.1}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.0, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.1}]}, "affected": [{"source": "meissner@suse.de", "affectedData": [{"repo": "https://github.com/rancher/fleet", "vendor": "SUSE", "product": "Rancher", "versions": [{"status": "affected", "version": "0.15.0", "lessThan": "0.15.2", "versionType": "semver"}, {"status": "affected", "version": "0.14.0", "lessThan": "0.14.6", "versionType": "semver"}, {"status": "affected", "version": "0.13.0", "lessThan": "0.13.11", "versionType": "semver"}, {"status": "affected", "version": "0.12.0", "lessThan": "0.12.15", "versionType": "semver"}], "packageName": "Fleet", "defaultStatus": "unaffected"}]}], "published": "2026-07-06T11:16:27.610", "references": [{"url": "https://github.com/advisories/GHSA-hx4v-cxpf-vh8m", "tags": ["Exploit", "Third Party Advisory", "Mitigation"], "source": "meissner@suse.de"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "meissner@suse.de", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "Missing filtering when the helmRepoURLRegex field isn't set on a GitRepo resource in SUSE Rancher Fleet's bundle reader in 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.15 forwards Helm authentication credentials (BasicAuth) to any URL specified in the helm.repo field of a fleet.yaml file, allowing attackers able to push to fleet monitored git repos to leak helm access credentials."}, {"lang": "es", "value": "Falta de filtrado cuando el campo helmRepoURLRegex no est\u00e1 configurado en un recurso GitRepo en el lector de paquetes de SUSE Rancher Fleet en 0.15 antes de 0.15.2, 0.14 antes de 0.14.6, 0.13 antes de 0.13.11 y 0.12 antes de 0.12.15, reenv\u00eda credenciales de autenticaci\u00f3n de Helm (BasicAuth) a cualquier URL especificada en el campo helm.repo de un archivo fleet.yaml, permitiendo a los atacantes capaces de enviar a repositorios Git monitoreados por Fleet filtrar credenciales de acceso de Helm."}], "lastModified": "2026-10-25T15:10:00.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:suse:rancher_fleet:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8DE7373C-74E0-4B59-AF44-ECB9AC0130B9", "versionEndExcluding": "0.12.15", "versionStartIncluding": "0.12.0"}, {"criteria": "cpe:2.3:a:suse:rancher_fleet:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D76AA40B-6291-46DC-BE27-BF4B8F6A8B23", "versionEndExcluding": "0.13.11", "versionStartIncluding": "0.13.0"}, {"criteria": "cpe:2.3:a:suse:rancher_fleet:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F267A8DC-9A24-4A98-B765-CEEC0EBC2576", "versionEndExcluding": "0.14.6", "versionStartIncluding": "0.14.0"}, {"criteria": "cpe:2.3:a:suse:rancher_fleet:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BE1A7C49-CBBF-45BA-91F1-D2DA940BE908", "versionEndExcluding": "0.15.2", "versionStartIncluding": "0.15.0"}], "operator": "OR"}]}], "sourceIdentifier": "meissner@suse.de"}