# CVE-2026-44935: SUSE Rancher Fleet improper validation in Helm Deployer

Source: https://junglewise.ai/threats/cve-2026-44935-suse-rancher-fleet-improper-validation-in-helm-deployer  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-02. Updated: 2026-07-02  
License: CC BY 4.0 with a link back

CVE-2026-44935 · Severity: critical · CVSS 9.9 · Published 2026-07-02

SUSE Rancher Fleet, a tool used to manage and deploy applications across large groups of Kubernetes clusters, contains a vulnerability that affects multi-tenant environments. In these setups, one user or team could bypass security boundaries to access sensitive credentials, secrets, and configuration data belonging to other teams. This could allow an attacker to take full control over shared clusters or steal sensitive information used by other parts of the organization.

Technologies: [github.com/rancher/fleet (Go)](https://junglewise.ai/threats/technologies/github-com-rancher-fleet), [Suse Fleet](https://junglewise.ai/threats/technologies/fleet). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Suse](https://junglewise.ai/threats/vendors/suse).

## Quick answers

**Is CVE-2026-44935 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44935 being exploited in the wild.

**How severe is CVE-2026-44935?** Critical severity, with a CVSS score of 9.9, published 2 July 2026.

**Which products and versions are affected?** github.com/rancher/fleet (Go) SEMVER:introduced=0.12.0,fixed=0.12.15,introduced=0.13.0,fixed=0.13.11,introduced=0.14.0,fixed=0.14.6,introduced=0.15.0,fixed=0.15.2, SEMVER:introduced=0.15.0,fixed=0.15.2; Suse Fleet 0.15.0 before 0.15.2, 0.14.0 before 0.14.6, 0.13.0 before 0.13.11, 0.12.0 before 0.12.15.

**Is there a fix for CVE-2026-44935?** Yes. github.com/rancher/fleet (Go): upgrade to 0.15.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44935 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-44935?** Check whether you run github.com/rancher/fleet (Go) or Suse Fleet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/rancher/fleet (Go): upgrade to 0.15.2 or later

  ```sh
  go get github.com/rancher/fleet@v0.15.2
  ```


## Technical details

A vulnerability in the Helm Deployer component of SUSE Rancher Fleet arises from improper validation of 'valuesFrom' references. In multi-tenant environments where different tenants share downstream clusters, an attacker with low-privileged access can use 'valuesFrom' in a fleet.yaml file (via GitRepo) or a HelmOp resource to read secrets and ConfigMaps across all namespaces, provided the resource names are known or guessed. Additionally, attackers can deploy HelmOp and Bundle resources without being restricted to a specific service account, potentially escalating privileges to cluster-wide resources. The fix introduces a new Policy resource to enforce specific service accounts and restrict repository URLs.

## Affected products

- SUSE Rancher Fleet 0.15.0 before 0.15.2, 0.14.0 before 0.14.6, 0.13.0 before 0.13.11, 0.12.0 before 0.12.15

## Identifiers

- CVE-2026-44935
- GHSA-xr65-5cpm-g36x
- GO-2026-5877

## Timeline

- 2026-05-27: advisory: GitHub advisory published by Rancher team
- 2026-07-02: disclosed: NVD publication date

## References

- [https://github.com/rancher/fleet/security/advisories/GHSA-xr65-5cpm-g36x](https://github.com/rancher/fleet/security/advisories/GHSA-xr65-5cpm-g36x)

## Related threats

- [Rancher Fleet insecure SSH certificate validation](https://junglewise.ai/threats/cve-2025-23390-fleet-doesn-t-validate-a-server-s-certificate-when-connecting)
- [SUSE Rancher Fleet Pod Security Standards bypass in agent-side deployer](https://junglewise.ai/threats/cve-2026-44938-suse-rancher-fleet-pod-security-standards-bypass-in-agent-side)
- [SUSE Rancher Fleet webhook request forgery via regex injection](https://junglewise.ai/threats/cve-2026-44937-suse-rancher-fleet-webhook-request-forgery-via-regex-injection)
- [SUSE Rancher Fleet credential leak via unvalidated Helm repository URL](https://junglewise.ai/threats/cve-2026-44936-suse-rancher-fleet-credential-leak-via-unvalidated-helm)
- [SUSE Rancher Fleet path traversal in ImageScan subsystem](https://junglewise.ai/threats/cve-2026-44948-suse-rancher-fleet-path-traversal-in-imagescan-subsystem)