CVE-2026-41050CWE-863broken-access-control

CVE-2026-41050

Critical · published May 13, 2026

CVSS v3.1
9.9
EPSS
0%
Percentile
37.4
In the wild
Unconfirmed
What it is

Fleet's Helm deployer did not fully apply ServiceAccount impersonation in two code paths, allowing a tenant with git push access to a Fleet-monitored repository to read secrets from any namespace on every downstream cluster targeted by their `GitRepo`.

The record
Technical detail
CVSS v3.1
9.9 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00442 · 37.4th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-05-13T12:16Z
Affected products (5)
ProductVersionsFixed in
suse/rancher_fleet≥ 0.11.0, < 0.11.130.11.13
suse/rancher_fleet≥ 0.12.0, < 0.12.140.12.14
suse/rancher_fleet≥ 0.13.0, < 0.13.100.13.10
suse/rancher_fleet≥ 0.14.0, < 0.14.50.14.5
suse/rancher_fleet≥ 0.15.0, < 0.15.10.15.1
References (2)
https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-41050 · [email protected]https://github.com/advisories/GHSA-765j-qfrp-hm3j · [email protected]
EPSS history
Timeline
  • 13 MAY 08:04Z
    Helm impersonation bypass of `RESTClientGetter` retains `cluster-admin` during template rendering
    cvelistv5