https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 15:24:50 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-318373 EUVD-2026-318373 https://cve.radiocsirt.org/vuln/euvd-2026-318373 https://cve.radiocsirt.org/vuln/fkie_cve-2026-41050 <p>Fleet&#39;s Helm deployer did not fully apply ServiceAccount impersonation in two code paths, allowing a tenant with git push access to a Fleet-monitored repository to read secrets from any namespace on every downstream cluster targeted by their `GitRepo`.</p> <p>Fleet&#39;s Helm deployer did not fully apply ServiceAccount impersonation in two code paths, allowing a tenant with git push access to a Fleet-monitored repository to read secrets from any namespace on every downstream cluster targeted by their `GitRepo`.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-41050 https://cve.radiocsirt.org/vuln/ghsa-765j-qfrp-hm3j <p><strong>Affected:</strong> Go: github.com/rancher/fleet</p> <p>### Impact</p> <p>Fleet&#39;s Helm deployer did not fully apply ServiceAccount impersonation in two code paths, allowing a tenant with git push access to a Fleet-monitored repository to read secrets from any namespace on every downstream cluster targeted by their `GitRepo`.</p> <p>**Helm `lookup` bypass:** The Helm template engine ran Kubernetes API queries with the fleet-agent&#39;s cluster-admin credentials instead of the impersonated ServiceAccount. A chart template could therefore access resources beyond the tenant&#39;s RBAC scope.</p> <p>**`valuesFrom` bypass:** Secret and ConfigMap references in `fleet.yaml` `helm.valuesFrom` were read using the fleet-agent&#39;s cluster-admin client. A tenant could reference resources in namespaces the impersonated ServiceAccount has no access to. Both issues break Fleet&#39;s multi-tenant impersonation boundary. The leaked credentials may belong to external services, making the full impact non-deterministic. Single-tenant deployments where all users are trusted are not affected.</p> <p>**Important:** - For the exposure of additional credentials, the final impact severity for confidentiality, integrity and availability is dependent on the permissions the leaked credentials have on their services. - It is recommended to review for potentially leaked credentials in this scenario and to change them if deemed necessary.</p> <p>Please consult the associated [MITRE ATT&amp;CK - Technique - Account Access Removal](https://attack.mitre.org/techniques/T1531/) for further information about this…</p> <p><strong>Affected:</strong> Go: github.com/rancher/fleet</p> <p>### Impact</p> <p>Fleet&#39;s Helm deployer did not fully apply ServiceAccount impersonation in two code paths, allowing a tenant with git push access to a Fleet-monitored repository to read secrets from any namespace on every downstream cluster targeted by their `GitRepo`.</p> <p>**Helm `lookup` bypass:** The Helm template engine ran Kubernetes API queries with the fleet-agent&#39;s cluster-admin credentials instead of the impersonated ServiceAccount. A chart template could therefore access resources beyond the tenant&#39;s RBAC scope.</p> <p>**`valuesFrom` bypass:** Secret and ConfigMap references in `fleet.yaml` `helm.valuesFrom` were read using the fleet-agent&#39;s cluster-admin client. A tenant could reference resources in namespaces the impersonated ServiceAccount has no access to. Both issues break Fleet&#39;s multi-tenant impersonation boundary. The leaked credentials may belong to external services, making the full impact non-deterministic. Single-tenant deployments where all users are trusted are not affected.</p> <p>**Important:** - For the exposure of additional credentials, the final impact severity for confidentiality, integrity and availability is dependent on the permissions the leaked credentials have on their services. - It is recommended to review for potentially leaked credentials in this scenario and to change them if deemed necessary.</p> <p>Please consult the associated [MITRE ATT&amp;CK - Technique - Account Access Removal](https://attack.mitre.org/techniques/T1531/) for further information about this…</p> https://cve.radiocsirt.org/vuln/ghsa-765j-qfrp-hm3j https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1444 <p>Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Rancher Fleet Helm Deployer ausnutzen, um Sicherheitsvorkehrungen zu umgehen und vertrauliche Informationen offenzulegen, was möglicherweise weitere Angriffe ermöglicht.</p> <p>Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Rancher Fleet Helm Deployer ausnutzen, um Sicherheitsvorkehrungen zu umgehen und vertrauliche Informationen offenzulegen, was möglicherweise weitere Angriffe ermöglicht.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1444