https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T18:00:57.035806+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-318373 EUVD-2026-318373 2026-10-09T18:00:57.058742+00:00 EUVD-2026-318373 https://cve.radiocsirt.org/vuln/fkie_cve-2026-41050 fkie_cve-2026-41050 2026-10-09T18:00:57.058778+00:00

Fleet's Helm deployer did not fully apply ServiceAccount impersonation in two code paths, allowing a tenant with git push access to a Fleet-monitored repository to read secrets from any namespace on every downstream cluster targeted by their `GitRepo`.

 https://cve.radiocsirt.org/vuln/ghsa-765j-qfrp-hm3j GHSA-765j-qfrp-hm3j — Fleet: Helm impersonation bypass of `RESTClientGetter` retains `cluster-admin` during template rendering 2026-10-09T18:00:57.058812+00:00

Affected: Go: github.com/rancher/fleet

### Impact

Fleet's Helm deployer did not fully apply ServiceAccount impersonation in two code paths, allowing a tenant with git push access to a Fleet-monitored repository to read secrets from any namespace on every downstream cluster targeted by their `GitRepo`.

**Helm `lookup` bypass:** The Helm template engine ran Kubernetes API queries with the fleet-agent's cluster-admin credentials instead of the impersonated ServiceAccount. A chart template could therefore access resources beyond the tenant's RBAC scope.

**`valuesFrom` bypass:** Secret and ConfigMap references in `fleet.yaml` `helm.valuesFrom` were read using the fleet-agent's cluster-admin client. A tenant could reference resources in namespaces the impersonated ServiceAccount has no access to. Both issues break Fleet's multi-tenant impersonation boundary. The leaked credentials may belong to external services, making the full impact non-deterministic. Single-tenant deployments where all users are trusted are not affected.

**Important:** - For the exposure of additional credentials, the final impact severity for confidentiality, integrity and availability is dependent on the permissions the leaked credentials have on their services. - It is recommended to review for potentially leaked credentials in this scenario and to change them if deemed necessary.

Please consult the associated [MITRE ATT&CK - Technique - Account Access Removal](https://attack.mitre.org/techniques/T1531/) for further information about this…

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1444 WID-SEC-W-2026-1444 — Rancher Fleet Helm Deployer: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen 2026-10-09T18:00:57.058864+00:00

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Rancher Fleet Helm Deployer ausnutzen, um Sicherheitsvorkehrungen zu umgehen und vertrauliche Informationen offenzulegen, was möglicherweise weitere Angriffe ermöglicht.