# CVE-2026-104615: SUSE Rancher Fleet cluster identity takeover in registration

Source: https://junglewise.ai/threats/cve-2026-104615-a-security-vulnerability-was-discovered-in-suse-rancher-fleet-s  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-104615 · Severity: high · CVSS 7.9 · Published 2026-10-30

SUSE Rancher Fleet is a Kubernetes multi-cluster management tool that registers and manages remote clusters. A flaw in its cluster registration flow allows an attacker with a valid registration token to impersonate another cluster and gain unauthorized access to that cluster's managed secrets, configuration, and deployment controls within the shared Fleet workspace.

Technologies: [Suse Rancher Fleet](https://junglewise.ai/threats/technologies/rancher-fleet). Vendors: [Suse](https://junglewise.ai/threats/vendors/suse).

## Quick answers

**Is CVE-2026-104615 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-104615 being exploited in the wild.

**How severe is CVE-2026-104615?** High severity, with a CVSS score of 7.9, published 30 October 2026.

**Which products and versions are affected?** Suse Rancher Fleet before 0.12; 0.13.0 up to 0.13.17; 0.14.0 up to 0.14.12; 0.15.0 up to 0.15.17; 0.16.0 up to 0.16.3.

**Is there a fix for CVE-2026-104615?** Yes: fixed in Fleet 0.16.3, 0.15.17, 0.14.12, 0.13.17. Until then: Reduce exposure by issuing separate Fleet workspaces and registration tokens per tenant or trust boundary instead of registering clusters from different tenants in a shared workspace. Treat ClusterRegistrationToken resources as sensitive credentials by restricting read/create access via RBAC and maintaining short token TTLs. Monitor Fleet workspaces for unexpected ClusterRegistration objects and clusters that unexpectedly lose credentials. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-104615 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-104615?** Check whether you run Suse Rancher Fleet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Fleet 0.16.3, 0.15.17, 0.14.12, 0.13.17

Reduce exposure by issuing separate Fleet workspaces and registration tokens per tenant or trust boundary instead of registering clusters from different tenants in a shared workspace. Treat ClusterRegistrationToken resources as sensitive credentials by restricting read/create access via RBAC and maintaining short token TTLs. Monitor Fleet workspaces for unexpected ClusterRegistration objects and clusters that unexpectedly lose credentials.

## Technical details

The vulnerability exists in Fleet's cluster registration flow, where the cluster identity claimed during registration is not validated against the registration token used in the request. An attacker holding a valid registration token for a workspace and knowing the target cluster's client identifier can register with that identity using their own token, replacing the legitimate cluster's credentials. This allows disclosure of secrets and ConfigMaps in the target cluster's namespace and disruption of Fleet management, though deployment content cannot be modified.

## Affected products

- SUSE Rancher Fleet before 0.12; 0.13.0 up to 0.13.17; 0.14.0 up to 0.14.12; 0.15.0 up to 0.15.17; 0.16.0 up to 0.16.3

## Timeline

- 2026-10-29: disclosed
- 2026-10-30: advisory

## References

- [https://github.com/rancher/fleet/security/advisories/GHSA-gx8v-2929-9q95](https://github.com/rancher/fleet/security/advisories/GHSA-gx8v-2929-9q95)

## Related threats

- [SUSE Rancher Fleet privilege escalation in agent controller](https://junglewise.ai/threats/cve-2026-94290-suse-rancher-fleet-clusters-reference-a-kubeconfig-secret-that)
- [SUSE Rancher Fleet privilege escalation in resource deployment](https://junglewise.ai/threats/cve-2026-88808-a-vulnerability-has-been-identified-within-rancher-manager-where)
- [SUSE Rancher Fleet privilege mismatch in namespace metadata](https://junglewise.ai/threats/cve-2026-93540-a-privilege-mismatch-was-found-in-fleet-when-a-bundle-requested)
- [SUSE Rancher Fleet Git webhook authentication bypass](https://junglewise.ai/threats/cve-2026-93539-a-vulnerability-was-discovered-in-fleet-s-git-webhook-receiver)
- [SUSE Rancher Fleet cross-tenant authorization bypass via cluster labels](https://junglewise.ai/threats/cve-2026-93538-a-cross-tenant-authorization-issue-was-discovered-in-suse-rancher)