CVE-2026-93540Suse Rancher Fleet
NVDCVSS scored by meissner@suse.de
Vulnerability Summary
A privilege mismatch was found in Fleet. When a bundle requested namespace labels or annotations through the namespaceLabels and namespaceAnnotations options, the resulting namespace metadata update was not subject to the same authorization as the rest of the bundle's deployment. As a result, a bundle could change labels and annotations on a target namespace even when the identity it was pinned to was not authorized to modify that namespace.
This affected SUSE Rancher Fleet 0.16 before 0.16.2, 0.15 before 0.15.7, 0.14 before 0.14.11, 0.13 before 0.13.16 and potentially older versions.
This affected SUSE Rancher Fleet 0.16 before 0.16.2, 0.15 before 0.15.7, 0.14 before 0.14.11, 0.13 before 0.13.16 and potentially older versions.
CVSS v3.1 Base Metrics — Score 6.5 (MEDIUM)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:NAttack VectorNetwork
Attack ComplexityLow
Privileges RequiredLow
User InteractionNone
ScopeUnchanged
ConfidentialityNone
IntegrityHigh
AvailabilityNone
Affected & Patched Versions
- Suse Rancher Fleet >= 0.13.0 and < 0.13.16
- Suse Rancher Fleet >= 0.14.0 and < 0.14.11
- Suse Rancher Fleet >= 0.15.0 and < 0.15.7
- Suse Rancher Fleet >= 0.16.0 and < 0.16.1
- Suse Rancher Fleet 0.13.16
- Suse Rancher Fleet 0.14.11
- Suse Rancher Fleet 0.15.7
- Suse Rancher Fleet 0.16.1
What to do
Fix it during your normal patch cycle. No exploitation is confirmed yet.
- Check whether you run Suse Rancher Fleet and which version.
- Update to a patched version listed above, then confirm the new version.
Timeline
- Sep 28, 2026Published
- Oct 7, 2026Record last modified
Score, severity and exploitation changes are tracked from the day Watchtower started logging them.
Get notified about new Suse Rancher Fleet CVEsYou are reading CVE-2026-93540. Get an email when KEV listings, exploits or new CVEs match your stack.
Set up CVE alertsMore Suse Rancher Fleet CVEs
External References
Data last checked: Nov 14, 2026 13:06 UTC