# CVE-2026-93540: SUSE Rancher Fleet privilege mismatch in namespace metadata

Source: https://junglewise.ai/threats/cve-2026-93540-a-privilege-mismatch-was-found-in-fleet-when-a-bundle-requested  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-28. Updated: 2026-09-28  
License: CC BY 4.0 with a link back

CVE-2026-93540 · Severity: medium · CVSS 6.5 · Published 2026-09-28

SUSE Rancher Fleet, a GitOps cluster management tool, fails to properly authorize namespace label and annotation updates when bundles are deployed. An attacker can modify namespace metadata even when their service account lacks permission to change the namespace, potentially weakening security policies and access controls that administrators configured for multi-tenant deployments.

Technologies: [Suse Rancher Fleet](https://junglewise.ai/threats/technologies/rancher-fleet). Vendors: [Suse](https://junglewise.ai/threats/vendors/suse).

## Quick answers

**Is CVE-2026-93540 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-93540 being exploited in the wild.

**How severe is CVE-2026-93540?** Medium severity, with a CVSS score of 6.5, published 28 September 2026.

**Which products and versions are affected?** Suse Rancher Fleet 0.13 before 0.13.16, 0.14 before 0.14.11, 0.15 before 0.15.7, 0.16 before 0.16.2.

**Is there a fix for CVE-2026-93540?** A patch was published on 2026-09-23: Security advisory GHSA-m93g-8438-2cgg published with patches v0.16.1, v0.15.7, v0.14.11, v0.13.16 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-93540 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-93540?** Check whether you run Suse Rancher Fleet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authorization bypass (CWE-269/CWE-863) in the namespace metadata update logic. When a bundle specifies namespaceLabels or namespaceAnnotations, Fleet applies these updates with the Fleet agent's own identity rather than the bundle's pinned service account, bypassing downstream Kubernetes RBAC checks. This affects multi-tenant deployments where service account pinning is used; operator mode is unaffected. The fix applies namespace updates through the same impersonation path as the bundle deployment itself, gating all changes to the same RBAC authorization.

## Affected products

- SUSE Rancher Fleet 0.13 before 0.13.16, 0.14 before 0.14.11, 0.15 before 0.15.7, 0.16 before 0.16.2

## Timeline

- 2026-09-28: disclosed: CVE-2026-93540 published
- 2026-09-23: patched: Security advisory GHSA-m93g-8438-2cgg published with patches v0.16.1, v0.15.7, v0.14.11, v0.13.16

## References

- [https://github.com/rancher/fleet/security/advisories/GHSA-m93g-8438-2cgg](https://github.com/rancher/fleet/security/advisories/GHSA-m93g-8438-2cgg)

## Related threats

- [SUSE Rancher Fleet privilege escalation in agent controller](https://junglewise.ai/threats/cve-2026-94290-suse-rancher-fleet-clusters-reference-a-kubeconfig-secret-that)
- [SUSE Rancher Fleet cluster identity takeover in registration](https://junglewise.ai/threats/cve-2026-104615-a-security-vulnerability-was-discovered-in-suse-rancher-fleet-s)
- [SUSE Rancher Fleet privilege escalation in resource deployment](https://junglewise.ai/threats/cve-2026-88808-a-vulnerability-has-been-identified-within-rancher-manager-where)
- [SUSE Rancher Fleet Git webhook authentication bypass](https://junglewise.ai/threats/cve-2026-93539-a-vulnerability-was-discovered-in-fleet-s-git-webhook-receiver)
- [SUSE Rancher Fleet cross-tenant authorization bypass via cluster labels](https://junglewise.ai/threats/cve-2026-93538-a-cross-tenant-authorization-issue-was-discovered-in-suse-rancher)