Most recent entries from all

EUVD-2026-333788

2026-10-04T08:22:58.304127+00:00

EUVD-2026-333788

fkie_cve-2026-44938

2026-10-04T08:22:58.304158+00:00

A vulnerability has been identified in Fleet's agent-side deployer, which did not filter security-sensitive keys from namespaceLabels in fleet.yaml (or BundleDeployment.spec.options.namespaceLabels) when applying them to the target namespace.

An attacker with git push access to a Fleet-monitored repository could overwrite Pod Security Standards (PSS) enforcement labels on a target namespace. This allows the attacker to weaken admission controls and deploy workloads that PSS policies would otherwise block.

GHSA-864g-863m-vcvq — Fleet has PSS Bypass through addLabelsFromOptions in Fleet Agent

2026-10-04T08:22:58.304193+00:00

Affected: Go: github.com/rancher/fleet

### Impact A vulnerability has been identified in Fleet's agent-side deployer, which did not filter security-sensitive keys from `namespaceLabels` in `fleet.yaml` (or `BundleDeployment.spec.options.namespaceLabels`) when applying them to the target namespace.

An attacker with `git push` access to a Fleet-monitored repository could overwrite Pod Security Standards (PSS) enforcement labels on a target namespace. This allows the attacker to weaken admission controls and deploy workloads that PSS policies would otherwise block.

**Important:** The final impact on confidentiality, integrity, and availability depends on the specific permissions of the leaked credentials.

Fleet team recommends you: 1. Review your system for potentially leaked credentials. 2. Replace any credentials that may be compromised.

Please consult the associated [MITRE ATT&CK - Technique - Disable or Modify Tools](https://attack.mitre.org/techniques/T1685/) for further information about this category of attack.

### Patches To fix this issue, upgrade to a patched version. The updated Fleet deployer filters out labels with the `pod-security.kubernetes.io/` prefix when applying `namespaceLabels` to a namespace. This change preserves the PSS labels set by cluster administrators and prevents them from being overwritten through `fleet.yaml` or `BundleDeployment` options.

Patched versions of Fleet include releases `v0.15.2`, `v0.14.6`, `v0.13.11`, and `v0.12.15`.

### Workarounds If you can’t immediately up…

WID-SEC-W-2026-1715 — Fleet: Mehrere Schwachstellen

2026-10-04T08:22:58.304246+00:00

Ein Angreifer kann mehrere Schwachstellen in Fleet ausnutzen, um Sicherheitsmechanismen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuführen oder Sicherheitskonfigurationen zu manipulieren.