Rancher Fleet SSRF Vulnerability in Helm Repo Auth (CVE-2026-44936)

Vulnerability Overview Rancher Fleet has an SSRF (Server-Side Request Forgery) vulnerability in the Bundle Reader within due to unvalidated Helm repository URLs. When the field is not set in the resource, Fleet's bundle reader forwards Helm authentication credentials (BasicAuth) to any URL specified in the field. Attackers can exploit this behavior by pushing malicious URLs to repositories monitored by Fleet, thereby capturing usernames and passwords configured by administrators to access private Helm chart repositories. Affected Versions Affected Versions: - (Go) - >= 0.15.0, = 0.14.0, = 0.13.0, = 0.12.0, < 0.12.15 CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Changed - Confidentiality: Low - Integrity: None - Availability: None CVSS v3 Score: 5.0 / 10 Remediation Patched Versions: - 0.15.2 - 0.14.6 - 0.13.11 - 0.12.15 Upgrade Recommendations: - Upgrade Fleet to the patched versions. The patched versions require setting the field in the . If is empty or missing, Fleet will not send credentials regardless of the URL specified in . Workaround: - If upgrading to the patched version immediately is not possible, the following methods can be used to mitigate the risk and audit the environment: - Set on all resources that use . Ensure the regular expression matches only legitimate Helm repository URLs. Example Configuration Post-Upgrade Actions After upgrading to the patched version, review all auto-migrated resources by running the following command: Verify that the auto-generated regular expressions match only the expected Helm repository sources. If the regular expressions are too broad, replace them with more specific patterns. References CVE ID: CVE-2026-44936 GHSA ID: GHSA-hxvp-cqxl-v8tm Source Code: rancher/fleet Credits This security issue was reported by the following collaborators under the responsible disclosure policy: - Radasauskas Arnoladas from NATO and NATO Cyber Security Centre (NCSC). - The security team at Fluent.org. Related Links Contact the SUSE Rancher Security Team for security-related inquiries. Open an issue in the Rancher repository. Verify with the support team and product support lifecycle.

Goal Reached Thanks to every supporter — we hit 100%!

Rancher Fleet SSRF Vulnerability in Helm Repo Auth (CVE-2026-44936)

More from this source