What’s Vulnerable › Vulnerabilities
CVE-2026-93540: Fleet applies namespace labels and annotations without the bundle's service account privileges
- Severity: medium (CVSS 6.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-28 · updated 2026-10-07
- Weakness: CWE-266
Description
A privilege mismatch was found in Fleet. When a bundle requested namespace labels or annotations through the namespaceLabels and namespaceAnnotations options, the resulting namespace metadata update was not subject to the same authorization as the rest of the bundle's deployment. As a result, a bundle could change labels and annotations on a target namespace even when the identity it was pinned to was not authorized to modify that namespace. This affected SUSE Rancher Fleet 0.16 before 0.16.2, 0.15 before 0.15.7, 0.14 before 0.14.11, 0.13 before 0.13.16 and potentially older versions.
Affected products
- SUSE Fleet: from 0.13.0 before 0.13.16; from 0.14.0 before 0.14.11; from 0.15.0 before 0.15.7; from 0.16.0 before 0.16.1 — fixed in 0.13.16, 0.14.11, 0.15.7, 0.16.1
How to fix
Upgrade to a fixed version: SUSE Fleet 0.13.16, 0.14.11, 0.15.7, 0.16.1. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-93540 or the next vulnerability affects your stack