Executive brief
Rancher Fleet is a tool used to manage large-scale Kubernetes cluster deployments. A security flaw in its image scanning component allows an authorized user to trigger a denial-of-service attack. By providing a specially crafted file path, an attacker can force the system to perform excessive background work, blocking image scanning operations for all other users and potentially slowing down the management console.
Technical details
A path traversal vulnerability (CWE-22/CWE-23) exists in the Fleet ImageScan subsystem's GitRepo path handler. The Fleet controller fails to validate that resolved filesystem paths in 'gitrepo.Spec.Paths' remain within the cloned repository's temporary workspace. An authenticated attacker with RBAC permissions to create or modify GitRepo resources can use traversal sequences (e.g., '../../etc') to force the 'ScreeningLocalReader' to recursively walk directories outside the intended scope. This process consumes significant system resources and holds a global mutex, effectively blocking all ImageScan operations across the entire environment. The vulnerability is patched in versions 0.12.16, 0.13.12, 0.14.7, and 0.15.3.
Affected products
- SUSE Rancher Fleet >=0.12.0, <0.12.16; >=0.13.0, <0.13.12; >=0.14.0, <0.14.7; >=0.15.0, <0.15.3
Timeline
- 2026-06-29: advisory: GitHub Security Advisory published by Rancher
- 2026-06-30: disclosed: NVD publication date