Executive brief
SUSE Rancher Fleet, a tool used to manage large-scale Kubernetes deployments, contains a security flaw that can lead to the theft of credentials. If an attacker has the ability to push code to a Git repository monitored by Fleet, they can trick the system into sending private Helm repository login details to a server they control. This could allow an attacker to gain unauthorized access to private software packages and internal application charts.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in the SUSE Rancher Fleet bundle reader. When a GitRepo resource is configured with a Helm secret but lacks the 'helmRepoURLRegex' field, the Fleet controller will forward BasicAuth credentials to any URL specified in the 'helm.repo' field of a fleet.yaml file. An attacker with 'git push' access to a monitored repository can modify the fleet.yaml to point to a malicious server, capturing the username and password used for Helm chart authentication. Patched versions (0.15.2, 0.14.6, 0.13.11, 0.12.15) now require an explicit 'helmRepoURLRegex' to be set before credentials will be forwarded.
Affected products
- SUSE Rancher Fleet 0.15.0 before 0.15.2, 0.14.0 before 0.14.6, 0.13.0 before 0.13.11, 0.12.0 before 0.12.15
Timeline
- 2026-05-27: disclosed: Initial disclosure in rancher/fleet repository
- 2026-07-01: advisory: GitHub Advisory published/reviewed
- 2026-07-06: advisory: NVD publication date