CVE-2026-94290

Full vulnerability record from the local CVENow database.

Description

SUSE Rancher Fleet clusters reference a kubeconfig secret that the controller uses to install and manage a Fleet agent on the target cluster. The controller did not sufficiently restrict which kubeconfig secrets a Fleet Cluster object was allowed to reference. As a result, a Fleet cluster defined in a namespace an ordinary user controls could be associated with administrative credentials for the management cluster itself, causing the controller to manage the management cluster on that user's behalf and to run that user's Fleet content there with elevated privileges. This affects SUSE Rancher Fleet 0.16.0 up to 0.16.3, 0.15.0 up to 0.15.8, 0.14.0 up to 0.14.12, 0.13.0 up to 0.13.17 and possible older versions.

Severity

CRITICAL

CVSS score

9.1 (v3.1)

Vulnerability status

Received

Source identifier

[email protected]

Published

2026-11-02 16:17:45.190000

Last modified

2026-11-02 17:17:46.190000

View original CVE JSON

{
  "id": "CVE-2026-94290",
  "sourceIdentifier": "[email protected]",
  "published": "2026-11-02T16:17:45.190",
  "lastModified": "2026-11-02T17:17:46.190",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "SUSE Rancher Fleet clusters reference a kubeconfig secret that the controller uses to install and manage a Fleet agent on the target cluster. The controller did not sufficiently restrict which kubeconfig secrets a Fleet Cluster object was allowed to reference. As a result, a Fleet cluster defined in a namespace an ordinary user controls could be associated with administrative credentials for the management cluster itself, causing the controller to manage the management cluster on that user's behalf and to run that user's Fleet content there with elevated privileges. This affects SUSE Rancher Fleet 0.16.0 up to 0.16.3, 0.15.0 up to 0.15.8, 0.14.0 up to 0.14.12, 0.13.0 up to 0.13.17 and possible older versions."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "SUSE",
          "product": "Rancher",
          "defaultStatus": "unaffected",
          "packageName": "Fleet",
          "repo": "https://github.com/rancher/fleet",
          "versions": [
            {
              "version": "0.16.0",
              "lessThan": "0.16.3",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "0.15.0",
              "lessThan": "0.15.8",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "0.14.0",
              "lessThan": "0.14.12",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "0.13.0",
              "lessThan": "0.13.17",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 6.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-11-02T16:13:30.631420Z",
          "id": "CVE-2026-94290",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-250"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/rancher/fleet/security/advisories/GHSA-qfmw-gw96-ffcr",
      "source": "[email protected]"
    }
  ]
}