What’s Vulnerable › Vulnerabilities
CVE-2026-104615: Cluster identity takeover in Fleet cluster registration allows access to another cluster's Fleet namespace
- Severity: high (CVSS 7.9 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-30 · updated 2026-10-30
- Weakness: CWE-290
Description
A security vulnerability was discovered in SUSE Rancher Fleet's cluster registration flow, in Fleet versions before 0.12, 0.13.0 up to 0.13.17, 0.14.0 up to 0.14.12, 0.15.0 up t o 0.15.17 and 0.16.0 up to 0.16.3. The cluster identity claimed by a registration request was accepted without being bound to the registration token that the request was made with. As a result, a registration request could be associated with a managed cluster that was originally registered with a different registration token.
Affected products
- SUSE Rancher: from 0.16.0 before 0.16.3; from 0.15.0. before 0.15.17; from 0.14.0 before 0.14.12; from 0.13 before 0.13.17; through 0.12 — fixed in 0.16.3, 0.15.17, 0.14.12, 0.13.17
How to fix
Upgrade to a fixed version: SUSE Rancher 0.16.3, 0.15.17, 0.14.12, 0.13.17. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-104615 or the next vulnerability affects your stack