Executive brief
Rancher Fleet, a tool for managing large-scale Kubernetes cluster deployments, contains a vulnerability that allows users in a multi-tenant environment to bypass security boundaries. An attacker with the ability to push code to a monitored repository can exploit this to read sensitive secrets and configuration data from any namespace across all managed clusters. This could lead to a total compromise of the managed infrastructure and any external services whose credentials are stored within the clusters.
Technical details
Rancher Fleet's Helm deployer fails to consistently apply ServiceAccount impersonation in two specific code paths: the Helm `lookup` function and the `valuesFrom` directive in `fleet.yaml`. In both cases, the system defaults to using the `fleet-agent`'s high-privilege `cluster-admin` credentials instead of the restricted tenant ServiceAccount. An attacker with 'git push' access to a Fleet-monitored repository can craft malicious Helm charts or configuration files to query the Kubernetes API or reference Secrets and ConfigMaps in unauthorized namespaces. This effectively breaks the multi-tenant isolation boundary, allowing for cross-namespace data exfiltration. The issue is resolved by ensuring the `RESTClientGetter` and Helm action configurations strictly use the impersonated credentials.
Affected products
- Rancher Fleet >= 0.15.0, < 0.15.1; >= 0.14.0, < 0.14.5; >= 0.13.0, < 0.13.10; >= 0.12.0, < 0.12.14; >= 0.11.0, < 0.11.13
Timeline
- 2026-04-30: disclosed: Initial disclosure to rancher/fleet
- 2026-05-07: advisory: GitHub Advisory published