CVE-2026-44938: SUSE Rancher Fleet Pod Security Standards bypass in agent-side deployer

CVE-2026-44938 · Severity: high · CVSS 8.8 · Published 2026-07-07

A vulnerability in the Fleet deployment tool allows users with access to a connected Git repository to bypass security policies on Kubernetes clusters. By modifying configuration files, an attacker can disable Pod Security Standards (PSS) for specific namespaces. This enables them to deploy unauthorized or malicious workloads that would normally be blocked by the system's security controls.

Technologies: github.com/rancher/fleet (Go), Suse Fleet. Vendors: Go, Suse.

Quick answers

Is CVE-2026-44938 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-44938 being exploited in the wild.
How severe is CVE-2026-44938?
High severity, with a CVSS score of 8.8, published 7 July 2026.
Which products and versions are affected?
github.com/rancher/fleet (Go) SEMVER:introduced=0.12.0,fixed=0.12.15,introduced=0.13.0,fixed=0.13.11,introduced=0.14.0,fixed=0.14.6,introduced=0.15.0,fixed=0.15.2, SEMVER:introduced=0.15.0,fixed=0.15.2; Suse Fleet >= 0.12.0, < 0.12.15; >= 0.13.0, < 0.13.11; >= 0.14.0, < 0.14.6; >= 0.15.0, < 0.15.2, >= 0.15.0, < 0.15.2; >= 0.14.0, < 0.14.6; >= 0.13.0, < 0.13.11; >= 0.12.0, < 0.12.15.
Is there a fix for CVE-2026-44938?
Yes. github.com/rancher/fleet (Go): upgrade to 0.15.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44938 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-44938?
Check whether you run github.com/rancher/fleet (Go) or Suse Fleet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/rancher/fleet (Go): upgrade to 0.15.2 or later
    go get github.com/rancher/fleet@v0.15.2

Technical details

A vulnerability exists in Fleet's agent-side deployer where it fails to filter security-sensitive keys from 'namespaceLabels' in fleet.yaml or BundleDeployment options. An attacker with low-privileged 'git push' access to a Fleet-monitored repository can provide malicious labels that overwrite existing Pod Security Standards (PSS) enforcement labels on a target namespace. This allows the attacker to weaken admission controls, facilitating the deployment of privileged or otherwise restricted workloads. The issue is addressed in versions 0.15.2, 0.14.6, 0.13.11, and 0.12.15 by filtering out labels with the 'pod-security.kubernetes.io/' prefix.

Affected products

  • SUSE Rancher Fleet >= 0.15.0, < 0.15.2; >= 0.14.0, < 0.14.6; >= 0.13.0, < 0.13.11; >= 0.12.0, < 0.12.15

Identifiers

  • CVE-2026-44938
  • GHSA-864g-863m-vcvq
  • GO-2026-5871

Timeline

  • 2026-05-27: disclosed: Initial disclosure in rancher/fleet repository
  • 2026-07-01: advisory: GitHub Advisory published
  • 2026-07-07: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.