Is CVE-2026-44935 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44935 being exploited in the wild.

How severe is CVE-2026-44935?

Critical severity, with a CVSS score of 9.9, published 2 July 2026.

Which products and versions are affected?

github.com/rancher/fleet (Go) SEMVER:introduced=0.12.0,fixed=0.12.15,introduced=0.13.0,fixed=0.13.11,introduced=0.14.0,fixed=0.14.6,introduced=0.15.0,fixed=0.15.2, SEMVER:introduced=0.15.0,fixed=0.15.2; Suse Fleet 0.15.0 before 0.15.2, 0.14.0 before 0.14.6, 0.13.0 before 0.13.11, 0.12.0 before 0.12.15.

Is there a fix for CVE-2026-44935?

Yes. github.com/rancher/fleet (Go): upgrade to 0.15.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-44935 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-44935?

Check whether you run github.com/rancher/fleet (Go) or Suse Fleet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44935: SUSE Rancher Fleet improper validation in Helm Deployer

CVE-2026-44935 · Severity: critical · CVSS 9.9 · Published 2026-07-02

SUSE Rancher Fleet, a tool used to manage and deploy applications across large groups of Kubernetes clusters, contains a vulnerability that affects multi-tenant environments. In these setups, one user or team could bypass security boundaries to access sensitive credentials, secrets, and configuration data belonging to other teams. This could allow an attacker to take full control over shared clusters or steal sensitive information used by other parts of the organization.

Technologies: github.com/rancher/fleet (Go), Suse Fleet. Vendors: Go, Suse.

Quick answers

Is CVE-2026-44935 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44935 being exploited in the wild.
How severe is CVE-2026-44935?: Critical severity, with a CVSS score of 9.9, published 2 July 2026.
Which products and versions are affected?: github.com/rancher/fleet (Go) SEMVER:introduced=0.12.0,fixed=0.12.15,introduced=0.13.0,fixed=0.13.11,introduced=0.14.0,fixed=0.14.6,introduced=0.15.0,fixed=0.15.2, SEMVER:introduced=0.15.0,fixed=0.15.2; Suse Fleet 0.15.0 before 0.15.2, 0.14.0 before 0.14.6, 0.13.0 before 0.13.11, 0.12.0 before 0.12.15.
Is there a fix for CVE-2026-44935?: Yes. github.com/rancher/fleet (Go): upgrade to 0.15.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44935 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-44935?: Check whether you run github.com/rancher/fleet (Go) or Suse Fleet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/rancher/fleet (Go): upgrade to 0.15.2 or later
```
go get github.com/rancher/fleet@v0.15.2
```

Technical details

A vulnerability in the Helm Deployer component of SUSE Rancher Fleet arises from improper validation of 'valuesFrom' references. In multi-tenant environments where different tenants share downstream clusters, an attacker with low-privileged access can use 'valuesFrom' in a fleet.yaml file (via GitRepo) or a HelmOp resource to read secrets and ConfigMaps across all namespaces, provided the resource names are known or guessed. Additionally, attackers can deploy HelmOp and Bundle resources without being restricted to a specific service account, potentially escalating privileges to cluster-wide resources. The fix introduces a new Policy resource to enforce specific service accounts and restrict repository URLs.

Affected products

SUSE Rancher Fleet 0.15.0 before 0.15.2, 0.14.0 before 0.14.6, 0.13.0 before 0.13.11, 0.12.0 before 0.12.15

Identifiers

CVE-2026-44935
GHSA-xr65-5cpm-g36x
GO-2026-5877

Timeline

2026-05-27: advisory: GitHub advisory published by Rancher team
2026-07-02: disclosed: NVD publication date

References

https://github.com/rancher/fleet/security/advisories/GHSA-xr65-5cpm-g36x

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.