Rancher Fleet PSS Bypass via addLabelsFromOptions (CVE-2026-44938) Advisory

Vulnerability Overview Vulnerability Name: Fleet has PSS Bypass through addLabelsFromOptions in Fleet Agent CVE ID: CVE-2026-44938 GHSA ID: GHSA-864g-863m-vcxq Severity: High (CVSS v3 Base Score 8.8 / 10) Description: A vulnerability was discovered in Fleet’s agent-side deployer, which fails to filter sensitive keys from (in or ) when they are applied to the target namespace. An attacker with access to a Git repository monitored by Fleet via can overwrite Pod Security Standards (PSS) enforcement labels, allowing the attacker to weaken access controls and deploy workloads that would otherwise be blocked by PSS policies. Affected Versions Affected Versions: - (Go) - >= 0.15.0, = 0.14.0, = 0.13.0, = 0.12.0, < 0.12.15 CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Confidentiality: High - Integrity: High - Availability: High Remediation Patch Versions Upgrade to the following patch versions: - v0.15.2 - v0.14.6 - v0.13.11 - v0.12.15 Temporary Workarounds 1. Deploy NeuVector (Primary Workaround) - Deploy NeuVector (SUSE Security) and configure admission control rejection rules to block "running as privileged." - NeuVector evaluates pod specifications independently of Kubernetes PSS namespace label evaluation. Even if labels are downgraded, it will block privileged containers. - Although namespace labels may still be overwritten, attackers cannot exploit Confidentiality, Integrity, or Availability without a privileged pod. 2. Restrict Repository Access (Secondary Workaround) - Note: The following measures reduce the attack surface but do not fully mitigate the vulnerability. - In multi-tenant environments, this restriction removes the primary attack vector. However, this measure only reduces the attack surface and does not fully close the vulnerability. It may not be applicable to all organizations. Additional Information Team Recommendations: 1. Review systems for potential credential leakage. 2. Rotate any credentials that may have been compromised. References: - MITRE ATT&CK - Technique: Disable or Modify Tools - SUSE Rancher Security Team - Rancher Repository - Support Matrix and Product Support Lifecycles Credits: - This security issue was reported by the following collaborator under our responsible disclosure policy: - Radisavskas Arnoldas from NATO and NATO Cyber Security Centre (NCSC) Publication Date: May 26, 2023 Last Updated: Last week

Goal Reached Thanks to every supporter — we hit 100%!

Rancher Fleet PSS Bypass via addLabelsFromOptions (CVE-2026-44938) Advisory

More from this source