# CVE-2026-44937: SUSE Rancher Fleet webhook request forgery via regex injection

Source: https://junglewise.ai/threats/cve-2026-44937-suse-rancher-fleet-webhook-request-forgery-via-regex-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-06. Updated: 2026-07-06  
License: CC BY 4.0 with a link back

CVE-2026-44937 · Severity: high · CVSS 7.5 · Published 2026-07-06

SUSE Rancher Fleet, a tool used to manage large-scale Kubernetes deployments, contains a vulnerability in how it handles update notifications (webhooks). If these notifications are not protected by a secret password, an attacker can send fake messages to the system. This can be used to force the system into a loop of downloading data, causing a service outage, or to force applications to revert to older, potentially insecure versions of their code.

Technologies: [github.com/rancher/fleet (Go)](https://junglewise.ai/threats/technologies/github-com-rancher-fleet), [Suse Fleet](https://junglewise.ai/threats/technologies/fleet). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Suse](https://junglewise.ai/threats/vendors/suse).

## Quick answers

**Is CVE-2026-44937 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44937 being exploited in the wild.

**How severe is CVE-2026-44937?** High severity, with a CVSS score of 7.5, published 6 July 2026.

**Which products and versions are affected?** github.com/rancher/fleet (Go) SEMVER:introduced=0.12.0,fixed=0.12.15,introduced=0.13.0,fixed=0.13.11,introduced=0.14.0,fixed=0.14.6,introduced=0.15.0,fixed=0.15.2, SEMVER:introduced=0.15.0,fixed=0.15.2; Suse Fleet 0.15.0 to 0.15.1, 0.14.0 to 0.14.5, 0.13.0 to 0.13.10, 0.12.0 to 0.12.14.

**Is there a fix for CVE-2026-44937?** Yes. github.com/rancher/fleet (Go): upgrade to 0.15.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44937 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-44937?** Check whether you run github.com/rancher/fleet (Go) or Suse Fleet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/rancher/fleet (Go): upgrade to 0.15.2 or later

  ```sh
  go get github.com/rancher/fleet@v0.15.2
  ```


## Technical details

A vulnerability in SUSE Rancher Fleet arises when the webhook endpoint is configured without a shared secret, leading to unsanitized repository URL components. The root cause is a lack of escaping for the URL and path received from webhooks, which allows for regex injection. A remote, unauthenticated attacker can forge webhook requests to trigger continuous repository re-cloning (Denial of Service) or force a downgrade of running services to any historical revision available in the remote Git repository. This exploit is possible even if the attacker does not know the specific repository path, provided they have read access to the target Git repository. Patches are available in versions 0.15.2, 0.14.6, 0.13.11, and 0.12.15.

## Affected products

- SUSE Rancher Fleet 0.15.0 to 0.15.1, 0.14.0 to 0.14.5, 0.13.0 to 0.13.10, 0.12.0 to 0.12.14

## Identifiers

- CVE-2026-44937
- GHSA-jmf4-m7j9-g72r
- GO-2026-5874

## Timeline

- 2026-05-27: advisory: GitHub Security Advisory published
- 2026-07-06: disclosed: CVE published to NVD

## References

- [https://github.com/rancher/fleet/security/advisories/GHSA-jmf4-m7j9-g72r](https://github.com/rancher/fleet/security/advisories/GHSA-jmf4-m7j9-g72r)

## Related threats

- [Rancher Fleet insecure SSH certificate validation](https://junglewise.ai/threats/cve-2025-23390-fleet-doesn-t-validate-a-server-s-certificate-when-connecting)
- [SUSE Rancher Fleet Pod Security Standards bypass in agent-side deployer](https://junglewise.ai/threats/cve-2026-44938-suse-rancher-fleet-pod-security-standards-bypass-in-agent-side)
- [SUSE Rancher Fleet credential leak via unvalidated Helm repository URL](https://junglewise.ai/threats/cve-2026-44936-suse-rancher-fleet-credential-leak-via-unvalidated-helm)
- [SUSE Rancher Fleet improper validation in Helm Deployer](https://junglewise.ai/threats/cve-2026-44935-suse-rancher-fleet-improper-validation-in-helm-deployer)
- [SUSE Rancher Fleet path traversal in ImageScan subsystem](https://junglewise.ai/threats/cve-2026-44948-suse-rancher-fleet-path-traversal-in-imagescan-subsystem)