What’s Vulnerable › Products

SUSE Fleet vulnerabilities

13 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 13 published in the last 12 months.

Check whether your SUSE Fleet version is affected

Latest SUSE Fleet vulnerabilities

• CVE-2025-23390 — Fleet doesn’t validate a server’s certificate when connecting through SSH (CVSS 6.3)
• CVE-2026-88808 — Fleet agent copies downstream resources with cluster-admin privileges, allowing cross-namespace writes on downstream clusters (CVSS 8.8)
• CVE-2026-93540 — Fleet applies namespace labels and annotations without the bundle's service account privileges (CVSS 6.5)
• CVE-2026-93539 — Unauthenticated GitRepo Spec Mutation via Fleet Git Webhook Receiver (CVSS 5.4)
• CVE-2026-93538 — Cross-tenant BundleDeployment and Secret disclosure via spoofed cluster labels during agent-initiated registration in Fleet (CVSS 7.1)
• CVE-2026-93537 — Path traversal in Fleet Helm valuesFiles allows disclosure of files outside the bundle directory (CVSS 6.5)
• CVE-2026-75036 — Fleet: DNS exfiltration via Sprig getHostByName in fleet.yaml Helm template preprocessing (CVSS 4.3)
• CVE-2026-44938 — Fleet has PSS Bypass through addLabelsFromOptions in Fleet Agent (CVSS 8.8)
• CVE-2026-44937 — SUSE Rancher Fleet had an Unauthenticated Webhook: Regex Injection via Unsanitized Repository URL Components (CVSS 8.2)
• CVE-2026-44936 — Rancher Fleet SSRF in Bundle Reader via Unvalidated Helm Repository URL in fleet.yaml (CVSS 5.0)
• CVE-2026-44935 — Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm Deployer (CVSS 9.9)
• CVE-2026-44948 — Path Traversal in Rancher Fleet ImageScan GitRepo Path Handler (CVSS 4.9)
• CVE-2026-41050 — Helm impersonation bypass of `RESTClientGetter` retains `cluster-admin` during template rendering (CVSS 9.9)