CVE-2026-44936

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-44936", "assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "state": "PUBLISHED", "assignerShortName": "suse", "dateReserved": "2026-05-08T12:29:48.967Z", "datePublished": "2026-07-06T09:30:20.688Z", "dateUpdated": "2026-07-06T12:47:45.102Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "shortName": "suse", "dateUpdated": "2026-07-06T09:30:20.688Z"}, "title": "Rancher Fleet SSRF in Bundle Reader via Unvalidated Helm Repository URL in fleet.yaml", "datePublic": "2026-05-28T09:28:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-918", "description": "CWE-918 Server-Side request forgery (SSRF)", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-122", "descriptions": [{"lang": "en", "value": "CAPEC-122 Privilege Abuse"}]}], "affected": [{"vendor": "SUSE", "product": "Rancher", "packageName": "Fleet", "repo": "https://github.com/rancher/fleet", "versions": [{"status": "affected", "version": "0.15.0", "lessThan": "0.15.2", "versionType": "semver"}, {"status": "affected", "version": "0.14.0", "lessThan": "0.14.6", "versionType": "semver"}, {"status": "affected", "version": "0.13.0", "lessThan": "0.13.11", "versionType": "semver"}, {"status": "affected", "version": "0.12.0", "lessThan": "0.12.15", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Missing filtering when the helmRepoURLRegex field isn't set on a GitRepo resource in SUSE Rancher Fleet's bundle reader in 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.15 forwards Helm authentication credentials (BasicAuth) to any URL specified in the helm.repo field of a fleet.yaml file, allowing attackers able to push to fleet monitored git repos to leak helm access credentials.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Missing filtering when the <code>helmRepoURLRegex</code> field isn't set on a <code>GitRepo</code> resource in SUSE Rancher Fleet's bundle reader in 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.15 forwards Helm authentication credentials (<code>BasicAuth</code>) to any URL specified in the <code>helm.repo</code> field of a <code>fleet.yaml</code> file, allowing attackers able to push to fleet monitored git repos to leak helm access credentials."}]}], "references": [{"url": "https://github.com/advisories/GHSA-hx4v-cxpf-vh8m", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N"}}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.2"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-06T12:47:38.527371Z", "id": "CVE-2026-44936", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-06T12:47:45.102Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-44936", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-06T12:47:38.527371Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-06T12:47:41.781Z"}}], "cna": {"title": "Rancher Fleet SSRF in Bundle Reader via Unvalidated Helm Repository URL in fleet.yaml", "source": {"discovery": "EXTERNAL"}, "impacts": [{"capecId": "CAPEC-122", "descriptions": [{"lang": "en", "value": "CAPEC-122 Privilege Abuse"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/rancher/fleet", "vendor": "SUSE", "product": "Rancher", "versions": [{"status": "affected", "version": "0.15.0", "lessThan": "0.15.2", "versionType": "semver"}, {"status": "affected", "version": "0.14.0", "lessThan": "0.14.6", "versionType": "semver"}, {"status": "affected", "version": "0.13.0", "lessThan": "0.13.11", "versionType": "semver"}, {"status": "affected", "version": "0.12.0", "lessThan": "0.12.15", "versionType": "semver"}], "packageName": "Fleet", "defaultStatus": "unaffected"}], "datePublic": "2026-05-28T09:28:00.000Z", "references": [{"url": "https://github.com/advisories/GHSA-hx4v-cxpf-vh8m", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 1.0.2"}, "descriptions": [{"lang": "en", "value": "Missing filtering when the helmRepoURLRegex field isn't set on a GitRepo resource in SUSE Rancher Fleet's bundle reader in 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.15 forwards Helm authentication credentials (BasicAuth) to any URL specified in the helm.repo field of a fleet.yaml file, allowing attackers able to push to fleet monitored git repos to leak helm access credentials.", "supportingMedia": [{"type": "text/html", "value": "Missing filtering when the <code>helmRepoURLRegex</code> field isn't set on a <code>GitRepo</code> resource in SUSE Rancher Fleet's bundle reader in 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.15 forwards Helm authentication credentials (<code>BasicAuth</code>) to any URL specified in the <code>helm.repo</code> field of a <code>fleet.yaml</code> file, allowing attackers able to push to fleet monitored git repos to leak helm access credentials.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918 Server-Side request forgery (SSRF)"}]}], "providerMetadata": {"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "shortName": "suse", "dateUpdated": "2026-07-06T09:30:20.688Z"}}}, "cveMetadata": {"cveId": "CVE-2026-44936", "state": "PUBLISHED", "dateUpdated": "2026-07-06T12:47:45.102Z", "dateReserved": "2026-05-08T12:29:48.967Z", "assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "datePublished": "2026-07-06T09:30:20.688Z", "assignerShortName": "suse"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageName": "Fleet", "product": "Rancher", "repo": "https://github.com/rancher/fleet", "vendor": "SUSE", "versions": [{"lessThan": "0.15.2", "status": "affected", "version": "0.15.0", "versionType": "semver"}, {"lessThan": "0.14.6", "status": "affected", "version": "0.14.0", "versionType": "semver"}, {"lessThan": "0.13.11", "status": "affected", "version": "0.13.0", "versionType": "semver"}, {"lessThan": "0.12.15", "status": "affected", "version": "0.12.0", "versionType": "semver"}]}], "source": "meissner@suse.de"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:suse:rancher_fleet:*:*:*:*:*:*:*:*", "matchCriteriaId": "8DE7373C-74E0-4B59-AF44-ECB9AC0130B9", "versionEndExcluding": "0.12.15", "versionStartIncluding": "0.12.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:suse:rancher_fleet:*:*:*:*:*:*:*:*", "matchCriteriaId": "D76AA40B-6291-46DC-BE27-BF4B8F6A8B23", "versionEndExcluding": "0.13.11", "versionStartIncluding": "0.13.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:suse:rancher_fleet:*:*:*:*:*:*:*:*", "matchCriteriaId": "F267A8DC-9A24-4A98-B765-CEEC0EBC2576", "versionEndExcluding": "0.14.6", "versionStartIncluding": "0.14.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:suse:rancher_fleet:*:*:*:*:*:*:*:*", "matchCriteriaId": "BE1A7C49-CBBF-45BA-91F1-D2DA940BE908", "versionEndExcluding": "0.15.2", "versionStartIncluding": "0.15.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Missing filtering when the helmRepoURLRegex field isn't set on a GitRepo resource in SUSE Rancher Fleet's bundle reader in 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.15 forwards Helm authentication credentials (BasicAuth) to any URL specified in the helm.repo field of a fleet.yaml file, allowing attackers able to push to fleet monitored git repos to leak helm access credentials."}, {"lang": "es", "value": "Falta de filtrado cuando el campo helmRepoURLRegex no est\u00e1 configurado en un recurso GitRepo en el lector de paquetes de SUSE Rancher Fleet en 0.15 antes de 0.15.2, 0.14 antes de 0.14.6, 0.13 antes de 0.13.11 y 0.12 antes de 0.12.15, reenv\u00eda credenciales de autenticaci\u00f3n de Helm (BasicAuth) a cualquier URL especificada en el campo helm.repo de un archivo fleet.yaml, permitiendo a los atacantes capaces de enviar a repositorios Git monitoreados por Fleet filtrar credenciales de acceso de Helm."}], "id": "CVE-2026-44936", "lastModified": "2026-10-25T15:10:00.147", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 1.4, "source": "meissner@suse.de", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44936", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-06T12:47:38.527371Z", "version": "2.0.3"}}]}, "published": "2026-07-06T11:16:27.610", "references": [{"source": "meissner@suse.de", "tags": ["Exploit", "Third Party Advisory", "Mitigation"], "url": "https://github.com/advisories/GHSA-hx4v-cxpf-vh8m"}], "sourceIdentifier": "meissner@suse.de", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "meissner@suse.de", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.15.0,0.15.2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.14.0,0.14.6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.13.0,0.13.11)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.12.0,0.12.15)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Rancher", "source": "cna", "vendor": "SUSE"}, "product": "rancher", "vendor": "suse"}], "created": "2026-07-06T11:30:04.523968+00:00", "updated": "2026-08-01T18:45:03.842262+00:00", "vendors": ["suse", "suse$PRODUCT$rancher"]}