Critical Rancher Fleet Vulnerabilities Patched in Update

TL;DR

SUSE released security advisories on October 29, 2026. The notices address two serious Rancher Fleet vulnerabilities in the GitOps management engine. The most critical flaw is CVE-2026-94290. It allows local privilege escalation to cluster-admin. Therefore, system administrators must install the latest software updates right away. They need to protect their clusters from takeover.

Why It Matters

Fleet is an open-source GitOps engine designed for multi-cluster Kubernetes management. It automates deployments across large fleets of clusters. According to industry estimates, thousands of enterprise organizations use Fleet through SUSE Rancher. Teams use it to manage container clusters at scale. Consequently, weaknesses in the Fleet control plane create substantial risks for enterprise workloads. Attackers can disrupt deployments and compromise sensitive business data.

Fortunately, SUSE confirmed that no active exploitation in the wild has occurred. In addition, researchers have shared no public proof-of-concept exploit code for either vulnerability.

How the Attack Works

The security bulletins detail two distinct flaws in agent management and cluster registration.

Agent Management Controller Privilege Escalation

First, CVE-2026-94290 represents a critical privilege escalation flaw in Fleet’s agent management controller. The GHSA-qfmw-gw96-ffcr security advisory explains the risk. It states: “The controller did not sufficiently restrict which kubeconfig secrets a Fleet Cluster object was allowed to reference.”

The controller runs with cluster-admin privileges on the management cluster. Because of this flaw, an ordinary user can define a custom cluster referencing administrative credentials. As a result, the controller executes the user’s payloads with root-level authority. In fact, “an authenticated Rancher user holding only the default user global role, with no role bindings at all on the local cluster, could obtain full cluster-admin on the Rancher management cluster.”

Cluster Identity Takeover via Registration Tokens

Meanwhile, the second flaw involves a cluster identity takeover tracked as CVE-2026-104615. The GHSA-gx8v-2929-9q95 security advisory warns of improper authorization during registration. The report notes: “The cluster identity claimed by a registration request was accepted without being bound to the registration token that the request was made with.” An attacker holding a valid workspace token can claim another cluster’s identity. Then, they can access secrets and disrupt management services.

Affected Versions

These Rancher Fleet vulnerabilities affect standalone Fleet versions before 0.16.3, 0.15.8, 0.14.12, and 0.13.17. They also impact Fleet bundled within Rancher versions before 2.15.3, 2.14.7, 2.13.11, and 2.12.15.

Patch and Mitigation Steps

SUSE resolved both issues in the latest releases. Administrators should update to Fleet 0.16.3 or patched Rancher releases immediately. Furthermore, teams should remove workspace self-service rights from untrusted accounts. Administrators should also audit clusters for unexpected role bindings.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.