{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "SUSE Rancher: all CVE events",
 "home_page_url": "https://patchwire.jonathanross.dev/products/suse--rancher/",
 "feed_url": "https://patchwire.jonathanross.dev/feeds/products/suse--rancher/all.json",
 "authors": [
  {
   "name": "Patchwire"
  }
 ],
 "language": "en",
 "items": [
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2024-22031/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2024-22031/",
   "title": "CVE-2024-22031 disclosed",
   "content_text": "A vulnerability has been identified within Rancher where a user with the ability to create a project, on a certain cluster, can create a project with the same name as an existing project in a different cluster. This results in the user gaining access to the other project in the different cluster, resulting in a privilege escalation. This happens because the namespace used on the local cluster to store related resources (PRTBs and secrets) is the name of the project.",
   "date_published": "2026-10-15T08:21:02Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2024-22031/fixed/chainguard",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2024-22031/",
   "title": "CVE-2024-22031 fixed in Chainguard",
   "content_text": "Fixed versions: harvester 1.8.1-r1, harvester-fips 1.8.1-r0, harvester-fips-webhook 1.8.1-r0, harvester-webhook 1.8.1-r1.",
   "date_published": "2026-10-15T08:21:02Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2024-22031/fixed/go",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2024-22031/",
   "title": "CVE-2024-22031 fixed upstream (Go)",
   "content_text": "Fixed versions: github.com/rancher/rancher 2.10.5, github.com/rancher/rancher 2.11.1, github.com/rancher/rancher 2.9.9.",
   "date_published": "2026-10-15T08:21:02Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2024-22031/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2024-22031/",
   "title": "CVE-2024-22031 fixed in openSUSE Tumbleweed",
   "content_text": "Fixed versions: govulncheck-vulndb 0.0.20250506T153719-1.1.",
   "date_published": "2026-10-15T08:21:02Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-88804/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-88804/",
   "title": "CVE-2026-88804 disclosed",
   "content_text": "An unauthenticated update of public UI settings could be used by remote attackers to execute a stored cross-site scripting attack in the Rancher UI, in SUSE Rancher 2.15 before 2.15.2, 2.14 before 2.14.6, 2.13 before 2.13.10, 2.12 before 2.12.14 and 2.11 before 2.11.18.",
   "date_published": "2026-09-28T15:58:34Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-88805/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-88805/",
   "title": "CVE-2026-88805 disclosed",
   "content_text": "Incorrect credential cleaning on logout could be used by remote attackers to keep access credentials even after the account was logged out. Affected is SUSE Rancher 2.15 before 2.15.2.",
   "date_published": "2026-09-28T15:50:34Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-88808/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-88808/",
   "title": "CVE-2026-88808 disclosed",
   "content_text": "A vulnerability has been identified within Rancher Manager where the Fleet agent wrote resources to downstream clusters using its own cluster-admin credentials instead of the ServiceAccount pinned to the deployment. It affects multi-tenancy environments where different tenants share the same downstream clusters, for example different privileged or untrusted teams inside the same organization. This could lead to overwritten configuration files.\n\nThis issue affected SUSE Rancher Fleet 0.16 before 0.16.2, 0.15 before 0.15.7, and 0.14 before 0.14.11.",
   "date_published": "2026-09-28T15:36:13Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-93540/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-93540/",
   "title": "CVE-2026-93540 disclosed",
   "content_text": "A privilege mismatch was found in Fleet. When a bundle requested namespace labels or annotations through the namespaceLabels and namespaceAnnotations options, the resulting namespace metadata update was not subject to the same authorization as the rest of the bundle's deployment. As a result, a bundle could change labels and annotations on a target namespace even when the identity it was pinned to was not authorized to modify that namespace.\n\nThis affected SUSE Rancher Fleet 0.16 before 0.16.2, 0.15 before 0.15.7, 0.14 before 0.14.11, 0.13 before 0.13.16 and potentially older versions.",
   "date_published": "2026-09-28T14:45:42Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-93539/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-93539/",
   "title": "CVE-2026-93539 disclosed",
   "content_text": "A vulnerability was discovered in Fleet's Git webhook receiver (the gitjob webhook service). When a webhook secret is not configured, incoming webhook requests are accepted without verification, and processing a request can change the spec.pollingInterval field of a matching GitRepo resource in any namespace. A caller with network access to the webhook service and no Kubernetes credentials can therefore alter GitRepo configuration outside\n\nthe namespaces they are authorized for.  This only affects SUSE Rancher Fleet 0.16 before 0.16.2, older versions are not affected.",
   "date_published": "2026-09-28T14:19:55Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-93538/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-93538/",
   "title": "CVE-2026-93538 disclosed",
   "content_text": "A cross-tenant authorization issue was discovered in SUSE Rancher Fleet. During agent-initiated cluster registration, cluster labels supplied by the registering agent, including labels in the reserved management.cattle.io/ namespace such as the cluster display name label, were applied to the resulting upstream Cluster object. Because Fleet resolves GitRepo and Bundle targets from those cluster labels, a party able to register a cluster into a Fleet workspace namespace shared with other tenants could cause its own cluster to satisfy targeting rules that administrators intended for a different cluster.\nThis affects SUSE Rancher Fleet 0.16 before 0.16.1, 0.15 before 0.15.6, 0.14 before 0.14.10, 0.13 before 0.13.15, 0.12 before 0.12.19 and older versions.",
   "date_published": "2026-09-28T14:10:21Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-93537/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-93537/",
   "title": "CVE-2026-93537 disclosed",
   "content_text": "A user who can supply bundle content to a repository referenced by a GitRepo resource, for example through Git push access, or through permission to create or modify a GitRepo, can cause SUSE Rancher Fleet to read files from the filesystem of the environment that processes the bundle and include their contents in the generated Bundle resource. This can expose configuration or credential material that the user has no Kubernetes RBAC permission to read, including Helm registry credentials made available to the bundle-processing job when per-path Helm credentials are configured.\nThis affects Fleet 0.16 before 0.16.2, 0.15 before 0.15.7, 0.14 before 0.14.11, 0.13 before 0.13.16, 0.12 before 0.12.20 and potentially older unsupported versions.",
   "date_published": "2026-09-28T13:29:10Z"
  }
 ]
}