# CVE-2026-44938: SUSE Rancher Fleet Pod Security Standards bypass in agent-side deployer

Source: https://junglewise.ai/threats/cve-2026-44938-suse-rancher-fleet-pod-security-standards-bypass-in-agent-side  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-07. Updated: 2026-07-07  
License: CC BY 4.0 with a link back

CVE-2026-44938 · Severity: high · CVSS 8.8 · Published 2026-07-07

A vulnerability in the Fleet deployment tool allows users with access to a connected Git repository to bypass security policies on Kubernetes clusters. By modifying configuration files, an attacker can disable Pod Security Standards (PSS) for specific namespaces. This enables them to deploy unauthorized or malicious workloads that would normally be blocked by the system's security controls.

Technologies: [github.com/rancher/fleet (Go)](https://junglewise.ai/threats/technologies/github-com-rancher-fleet), [Suse Fleet](https://junglewise.ai/threats/technologies/fleet). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Suse](https://junglewise.ai/threats/vendors/suse).

## Quick answers

**Is CVE-2026-44938 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44938 being exploited in the wild.

**How severe is CVE-2026-44938?** High severity, with a CVSS score of 8.8, published 7 July 2026.

**Which products and versions are affected?** github.com/rancher/fleet (Go) SEMVER:introduced=0.12.0,fixed=0.12.15,introduced=0.13.0,fixed=0.13.11,introduced=0.14.0,fixed=0.14.6,introduced=0.15.0,fixed=0.15.2, SEMVER:introduced=0.15.0,fixed=0.15.2; Suse Fleet >= 0.12.0, < 0.12.15; >= 0.13.0, < 0.13.11; >= 0.14.0, < 0.14.6; >= 0.15.0, < 0.15.2, >= 0.15.0, < 0.15.2; >= 0.14.0, < 0.14.6; >= 0.13.0, < 0.13.11; >= 0.12.0, < 0.12.15.

**Is there a fix for CVE-2026-44938?** Yes. github.com/rancher/fleet (Go): upgrade to 0.15.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44938 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-44938?** Check whether you run github.com/rancher/fleet (Go) or Suse Fleet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/rancher/fleet (Go): upgrade to 0.15.2 or later

  ```sh
  go get github.com/rancher/fleet@v0.15.2
  ```


## Technical details

A vulnerability exists in Fleet's agent-side deployer where it fails to filter security-sensitive keys from 'namespaceLabels' in fleet.yaml or BundleDeployment options. An attacker with low-privileged 'git push' access to a Fleet-monitored repository can provide malicious labels that overwrite existing Pod Security Standards (PSS) enforcement labels on a target namespace. This allows the attacker to weaken admission controls, facilitating the deployment of privileged or otherwise restricted workloads. The issue is addressed in versions 0.15.2, 0.14.6, 0.13.11, and 0.12.15 by filtering out labels with the 'pod-security.kubernetes.io/' prefix.

## Affected products

- SUSE Rancher Fleet >= 0.15.0, < 0.15.2; >= 0.14.0, < 0.14.6; >= 0.13.0, < 0.13.11; >= 0.12.0, < 0.12.15

## Identifiers

- CVE-2026-44938
- GHSA-864g-863m-vcvq
- GO-2026-5871

## Timeline

- 2026-05-27: disclosed: Initial disclosure in rancher/fleet repository
- 2026-07-01: advisory: GitHub Advisory published
- 2026-07-07: advisory: NVD publication date

## References

- [https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-44938](https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-44938)

## Related threats

- [Rancher Fleet insecure SSH certificate validation](https://junglewise.ai/threats/cve-2025-23390-fleet-doesn-t-validate-a-server-s-certificate-when-connecting)
- [SUSE Rancher Fleet webhook request forgery via regex injection](https://junglewise.ai/threats/cve-2026-44937-suse-rancher-fleet-webhook-request-forgery-via-regex-injection)
- [SUSE Rancher Fleet credential leak via unvalidated Helm repository URL](https://junglewise.ai/threats/cve-2026-44936-suse-rancher-fleet-credential-leak-via-unvalidated-helm)
- [SUSE Rancher Fleet improper validation in Helm Deployer](https://junglewise.ai/threats/cve-2026-44935-suse-rancher-fleet-improper-validation-in-helm-deployer)
- [SUSE Rancher Fleet path traversal in ImageScan subsystem](https://junglewise.ai/threats/cve-2026-44948-suse-rancher-fleet-path-traversal-in-imagescan-subsystem)