Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-94290— Privilege escalation to cluster-admin on the Rancher local cluster through Fleet's agent management controller

Quick assessment

Affected

SUSE Rancher

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

SUSE Rancher Fleet 集群引用了一个 kubeconfig 密钥（secret），控制器使用该密钥在目标集群中安装并管理 Fleet 代理。然而，该控制器未对 Fleet Cluster 对象可引用的 kubeconfig 密钥进行充分限制。因此，由普通用户控制的命名空间中定义的 Fleet 集群，可能被关联到管理集群自身的管理员凭据。这将导致控制器代表该用户管理管理集群，并在该集群中以提升的权限运行该用户的 Fleet 内容。此问题影响 SUSE Rancher Fleet 0.16.0 至 0.

CVSS 9.1 · Critical EPSS 0.50% · P43 Updated Nov 03, 2026

Possible ATT&CK Techniques 3 AI

T1068 · Exploitation for Privilege Escalation T1190 · Exploit Public-Facing Application T1548.001 · Setuid and Setgid

Affected Version Matrix 4

Vendor	Product	Version Range	Status
SUSE	Rancher	`0.16.0< 0.16.3`	affected
		`0.15.0< 0.15.8`	affected
		`0.14.0< 0.14.12`	affected
		`0.13.0< 0.13.17`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Privilege escalation to cluster-admin on the Rancher local cluster through Fleet's agent management controller

Source: CVE Program / CVE List V5

Vulnerability Description

SUSE Rancher Fleet clusters reference a kubeconfig secret that the controller uses to install and manage a Fleet agent on the target cluster. The controller did not sufficiently restrict which kubeconfig secrets a Fleet Cluster object was allowed to reference. As a result, a Fleet cluster defined in a namespace an ordinary user controls could be associated with administrative credentials for the management cluster itself, causing the controller to manage the management cluster on that user's behalf and to run that user's Fleet content there with elevated privileges. This affects SUSE Rancher Fleet 0.16.0 up to 0.16.3, 0.15.0 up to 0.15.8, 0.14.0 up to 0.14.12, 0.13.0 up to 0.13.17 and possible older versions.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

带着不必要的权限执行

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
SUSE	Rancher	0.16.0 ~ 0.16.3	-

II. Public POCs for CVE-2026-94290

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-94290

请登录查看更多情报信息。

Other References for CVE-2026-94290 (1)

https://github.com/rancher/fleet/security/advisories/GHSA-qfmw-gw96-ffcr vendor-advisory

https://www.cve.org/CVERecord?id=CVE-2026-94290

Same Patch Batch · SUSE · 2026-11-02 · 4 CVEs total

CVE-2026-88811	9.1 CRITICAL	Rancher credentials disclosed to third-party hosts by the Rancher Manager meta proxy
CVE-2026-88809	7.6 HIGH	Rancher meta proxy allowlist bypass leading to server-side request forgery
CVE-2026-88810	7.2 HIGH	Privilege escalation in downstream clusters via GlobalRole inheritedNamespacedRules

IV. Related Vulnerabilities

Same product: Rancher

Same vendor: SUSE

Same weakness: CWE-250