# CVE-2024-52284: GO-2025-3927 - Rancher Fleet Helm Values are stored inside BundleDeployment in plain text in github.com/rancher/fleet

Source: https://junglewise.ai/threats/cve-2024-52284-rancher-fleet-helm-values-are-stored-inside-bundledeployment-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-09-08  
License: CC BY 4.0 with a link back

CVE-2024-52284 · Severity: low · CVSS 3.1 · Published 2025-09-08

Rancher Fleet Helm Values are stored inside BundleDeployment in plain text in github.com/rancher/fleet

Technologies: [github.com/rancher/fleet (Go)](https://junglewise.ai/threats/technologies/github-com-rancher-fleet). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2024-52284 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-52284 being exploited in the wild.

**How severe is CVE-2024-52284?** Low severity, with a CVSS score of 3.1, published 8 September 2025.

**Which products and versions are affected?** github.com/rancher/fleet (Go) SEMVER:introduced=0.11.0,fixed=0.11.10,introduced=0.12.0,fixed=0.12.6,introduced=0.13.0,fixed=0.13.1-0.20250806151509-088bcbea7edb, SEMVER:introduced=0.13.0,fixed=0.13.1-0.20250806151509-088bcbea7edb.

**Is there a fix for CVE-2024-52284?** Yes. github.com/rancher/fleet (Go): upgrade to 0.13.1-0.20250806151509-088bcbea7edb or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2024-52284?** Check whether you run github.com/rancher/fleet (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/rancher/fleet (Go): upgrade to 0.13.1-0.20250806151509-088bcbea7edb or later

  ```sh
  go get github.com/rancher/fleet@v0.13.1-0.20250806151509-088bcbea7edb
  ```


## Affected products

- github.com/rancher/fleet (Go) SEMVER:introduced=0.11.0,fixed=0.11.10,introduced=0.12.0,fixed=0.12.6,introduced=0.13.0,fixed=0.13.1-0.20250806151509-088bcbea7edb, SEMVER:introduced=0.13.0,fixed=0.13.1-0.20250806151509-088bcbea7edb

## Identifiers

- CVE-2024-52284
- GHSA-6h9x-9j5v-7w9h
- GO-2025-3927

## Related threats

- [Rancher Fleet insecure SSH certificate validation](https://junglewise.ai/threats/cve-2025-23390-fleet-doesn-t-validate-a-server-s-certificate-when-connecting)
- [SUSE Rancher Fleet Pod Security Standards bypass in agent-side deployer](https://junglewise.ai/threats/cve-2026-44938-suse-rancher-fleet-pod-security-standards-bypass-in-agent-side)
- [SUSE Rancher Fleet webhook request forgery via regex injection](https://junglewise.ai/threats/cve-2026-44937-suse-rancher-fleet-webhook-request-forgery-via-regex-injection)
- [SUSE Rancher Fleet credential leak via unvalidated Helm repository URL](https://junglewise.ai/threats/cve-2026-44936-suse-rancher-fleet-credential-leak-via-unvalidated-helm)
- [SUSE Rancher Fleet improper validation in Helm Deployer](https://junglewise.ai/threats/cve-2026-44935-suse-rancher-fleet-improper-validation-in-helm-deployer)