November 14, 2026

CVE Watchtower

CVE-2026-44936Suse Rancher Fleet Server-Side Request Forgery (SSRF)

NVDCVSS scored by meissner@suse.de

Vulnerability Summary

Missing filtering when the helmRepoURLRegex field isn't set on a GitRepo resource in SUSE Rancher Fleet's bundle reader in 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.15 forwards Helm authentication credentials (BasicAuth) to any URL specified in the helm.repo field of a fleet.yaml file, allowing attackers able to push to fleet monitored git repos to leak helm access credentials.
Severity Level
MEDIUM(5.0)
Published Date
Jul 6, 2026
Last Modified
Oct 25, 2026
Exploitation Status
Public exploit available
EPSS Score (30-Day)
0.35%Probability
Root Weakness (CWE)
CWE-918: Server-Side Request Forgery (SSRF) β†—
The web server receives a URL or similar request from an upstream component and retrieves its contents, but does not sufficiently ensure that the request is being sent to the expected destination.
CVSS v3.1 Base Metrics — Score 5.0 (MEDIUM)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredLow
User InteractionNone
ScopeChanged
ConfidentialityLow
IntegrityNone
AvailabilityNone

Affected & Patched Versions

Affected Versions
  • Suse Rancher Fleet >= 0.12.0 and < 0.12.15
  • Suse Rancher Fleet >= 0.13.0 and < 0.13.11
  • Suse Rancher Fleet >= 0.14.0 and < 0.14.6
  • Suse Rancher Fleet >= 0.15.0 and < 0.15.2
Patched Versions
  • Suse Rancher Fleet 0.12.15
  • Suse Rancher Fleet 0.13.11
  • Suse Rancher Fleet 0.14.6
  • Suse Rancher Fleet 0.15.2

What to do

Prioritize this fix. Exploit code is public, so attacks can follow quickly.

  1. Check whether you run Suse Rancher Fleet and which version.
  2. Update to a patched version listed above, then confirm the new version.
  3. Review logs and exposed services for signs of earlier compromise.

Timeline

  • Jul 6, 2026Published
  • Oct 25, 2026Record last modified

Score, severity and exploitation changes are tracked from the day Watchtower started logging them.

Get notified about new Suse Rancher Fleet CVEsYou are reading CVE-2026-44936. Get an email when KEV listings, exploits or new CVEs match your stack.
Set up CVE alerts

Related Coverage

More Suse Rancher Fleet CVEs

External References

Data last checked: Nov 14, 2026 13:06 UTC