CVE-2026-41050
Fixed in a distro release EPSS <1%CVSS 9.9
Fleet's Helm deployer did not fully apply ServiceAccount impersonation in two code paths, allowing a tenant with git push access to a Fleet-monitored repository to read secrets from any namespace on every downstream cluster targeted by their `GitRepo`.
Products: SUSE Rancher
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/rancher/fleet | 0.15.1 |
| Go | github.com/rancher/fleet | 0.14.5 |
| Go | github.com/rancher/fleet | 0.13.10 |
| Go | github.com/rancher/fleet | 0.12.14 |
| Go | github.com/rancher/fleet | 0.11.13 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| openSUSE:Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 |