CVE Feed

    Dashboard / CVE / CVE-2026-93538

    CVE-2026-93538

    A cross-tenant authorization issue was discovered in SUSE Rancher Fleet. During agent-initiated cluster registration, cluster labels supplied by the registering agent, including labels in the reserved management.cattle.io/ namespace such as the cluster display name label, were applied to the resulting upstream Cluster object. Because Fleet resolves GitRepo and Bundle targets from those cluster labels, a party able to register a cluster into a Fleet workspace namespace shared with other tenants could cause its own cluster to satisfy targeting rules that administrators intended for a different cluster. This affects SUSE Rancher Fleet 0.16 before 0.16.1, 0.15 before 0.15.6, 0.14 before 0.14.10, 0.13 before 0.13.15, 0.12 before 0.12.19 and older versions.

    Published:Sep 28, 2026
    Last Modified:Oct 7, 2026
    EPS:Sep 28, 2026
    EPSS Score:0.00171
    CVSS Score:7.1

    Affected Products

    Vendor
    Suse
    Product
    Rancher
    Vendor
    Suse
    Product
    Rancher Fleet

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-88811 (CVSS 9.1) — Missing filtering in the SUSE Rancher Manager meta proxy could cause passed in rancher credentials to be leake…
    CVE-2026-88810 (CVSS 7.2) — A privilege escalation issue was discovered in Rancher Manager's role-based access control. The inheritedNames…
    CVE-2026-88809 (CVSS 7.6) — A security vulnerability exists in the SUSE Rancher Manager meta proxy endpoint (/meta/proxy). This endpoint i…
    CVE-2026-94290 (CVSS 9.1) — SUSE Rancher Fleet clusters reference a kubeconfig secret that the controller uses to install and manage a Fle…
    CVE-2026-104623 (CVSS 6.3) — A security vulnerability exists in the authorization handling for the local (management) cluster shell feature…
    CVE-2026-104615 (CVSS 7.9) — A security vulnerability was discovered in SUSE Rancher Fleet's cluster registration flow, in Fleet versions b…
    CVE-2024-22031 (CVSS 8.5) — A vulnerability has been identified within Rancher where a user with the ability to create a project, on a cer…
    CVE-2026-88804 (CVSS 9.6) — An unauthenticated update of public UI settings could be used by remote attackers to execute a stored cross-si…
    CVE-2026-88805 (CVSS 8.1) — Incorrect credential cleaning on logout could be used by remote attackers to keep access credentials even afte…
    CVE-2026-88808 (CVSS 8.8) — A vulnerability has been identified within Rancher Manager where the Fleet agent wrote resources to downstream…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High