High · published July 7, 2026
A vulnerability has been identified in Fleet's agent-side deployer, which did not filter security-sensitive keys from namespaceLabels in fleet.yaml (or BundleDeployment.spec.options.namespaceLabels) when applying them to the target namespace.
An attacker with git push access to a
Fleet-monitored repository could overwrite Pod Security Standards (PSS)
enforcement labels on a target namespace. This allows the attacker to
weaken admission controls and deploy workloads that PSS policies would
otherwise block.
| Product | Versions | Fixed in |
|---|---|---|
| suse/rancher_fleet | ≥ 0.12.0, < 0.12.15 | 0.12.15 |
| suse/rancher_fleet | ≥ 0.13.0, < 0.13.11 | 0.13.11 |
| suse/rancher_fleet | ≥ 0.14.0, < 0.14.6 | 0.14.6 |
| suse/rancher_fleet | ≥ 0.15.0, < 0.15.2 | 0.15.2 |