CVE-2026-94290

SUSE Rancher Fleet clusters reference a kubeconfig secret that the controller uses to install and manage a Fleet agent on the target cluster. The controller did not sufficiently restrict which kubeconfig secrets a Fleet Cluster object was allowed to reference. As a result, a Fleet cluster defined in a namespace an ordinary user controls could be associated with administrative credentials for the management cluster itself, causing the controller to manage the management cluster on that user's behalf and to run that user's Fleet content there with elevated privileges. This affects SUSE Rancher Fleet 0.16.0 up to 0.16.3, 0.15.0 up to 0.15.8, 0.14.0 up to 0.14.12, 0.13.0 up to 0.13.17 and possible older versions.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 2.3 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://github.com/rancher/fleet/security/advisories/GHSA-qfmw-gw96-ffcr

Configurations

No configuration.

History

02 Nov 2026, 16:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-11-02 16:17

Updated : 2026-11-03 05:18

NVD link : CVE-2026-94290

Mitre link : CVE-2026-94290

CVE.ORG link : CVE-2026-94290

JSON object : View

Products Affected

No product.

CWE

CWE-250

Execution with Unnecessary Privileges

{"id": "CVE-2026-94290", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-94290", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-11-02T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "meissner@suse.de", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.3}]}, "affected": [{"source": "meissner@suse.de", "affectedData": [{"repo": "https://github.com/rancher/fleet", "vendor": "SUSE", "product": "Rancher", "versions": [{"status": "affected", "version": "0.16.0", "lessThan": "0.16.3", "versionType": "semver"}, {"status": "affected", "version": "0.15.0", "lessThan": "0.15.8", "versionType": "semver"}, {"status": "affected", "version": "0.14.0", "lessThan": "0.14.12", "versionType": "semver"}, {"status": "affected", "version": "0.13.0", "lessThan": "0.13.17", "versionType": "semver"}], "packageName": "Fleet", "defaultStatus": "unaffected"}]}], "published": "2026-11-02T16:17:45.190", "references": [{"url": "https://github.com/rancher/fleet/security/advisories/GHSA-qfmw-gw96-ffcr", "source": "meissner@suse.de"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "meissner@suse.de", "description": [{"lang": "en", "value": "CWE-250"}]}], "descriptions": [{"lang": "en", "value": "SUSE Rancher Fleet clusters reference a kubeconfig secret that the controller uses to install and manage a Fleet agent on the target cluster. The controller did not sufficiently restrict which kubeconfig secrets a Fleet Cluster object was allowed to reference. As a result, a Fleet cluster defined in a namespace an ordinary user controls could be associated with administrative credentials for the management cluster itself, causing the controller to manage the management cluster on that user's behalf and to run that user's Fleet content there with elevated privileges. This affects SUSE Rancher Fleet 0.16.0 up to 0.16.3, 0.15.0 up to 0.15.8, 0.14.0 up to 0.14.12, 0.13.0 up to 0.13.17 and possible older versions."}], "lastModified": "2026-11-03T05:18:55.230", "sourceIdentifier": "meissner@suse.de"}