CVE-2026-44938

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-44938", "assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "state": "PUBLISHED", "assignerShortName": "suse", "dateReserved": "2026-05-08T12:29:48.967Z", "datePublished": "2026-07-07T13:05:03.344Z", "dateUpdated": "2026-07-08T03:56:44.251Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "shortName": "suse", "dateUpdated": "2026-07-07T13:05:03.344Z"}, "title": "Fleet has PSS Bypass through addLabelsFromOptions in Fleet Agent", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-522", "description": "CWE-522: Insufficiently Protected Credentials", "type": "CWE"}]}], "affected": [{"vendor": "SUSE", "product": "Rancher", "packageName": "github.com/rancher/fleet", "versions": [{"status": "affected", "version": "0.15.0", "lessThan": "0.15.2", "versionType": "semver"}, {"status": "affected", "version": "0.14.0", "lessThan": "0.14.6", "versionType": "semver"}, {"status": "affected", "version": "0.13.0", "lessThan": "0.13.11", "versionType": "semver"}, {"status": "affected", "version": "0.12.0", "lessThan": "0.12.15", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in Fleet's agent-side deployer, which did not filter security-sensitive keys from namespaceLabels in fleet.yaml (or BundleDeployment.spec.options.namespaceLabels) when applying them to the target namespace.\n\n\n\n\nAn attacker with git push access to a\n Fleet-monitored repository could overwrite Pod Security Standards (PSS)\n enforcement labels on a target namespace. This allows the attacker to \nweaken admission controls and deploy workloads that PSS policies would \notherwise block.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>A vulnerability has been identified in Fleet's agent-side deployer, which did not filter security-sensitive keys from <code>namespaceLabels</code> in <code>fleet.yaml</code> (or <code>BundleDeployment.spec.options.namespaceLabels</code>) when applying them to the target namespace.</p>\n<p>An attacker with <code>git push</code> access to a\n Fleet-monitored repository could overwrite Pod Security Standards (PSS)\n enforcement labels on a target namespace. This allows the attacker to \nweaken admission controls and deploy workloads that PSS policies would \notherwise block.</p>"}]}], "references": [{"url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-44938"}, {"url": "https://github.com/advisories/GHSA-864g-863m-vcvq"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-07T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-44938"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-08T03:56:44.251Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-44938", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-07T14:07:36.547547Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-07T14:07:45.835Z"}}], "cna": {"title": "Fleet has PSS Bypass through addLabelsFromOptions in Fleet Agent", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "SUSE", "product": "Rancher", "versions": [{"status": "affected", "version": "0.15.0", "lessThan": "0.15.2", "versionType": "semver"}, {"status": "affected", "version": "0.14.0", "lessThan": "0.14.6", "versionType": "semver"}, {"status": "affected", "version": "0.13.0", "lessThan": "0.13.11", "versionType": "semver"}, {"status": "affected", "version": "0.12.0", "lessThan": "0.12.15", "versionType": "semver"}], "packageName": "github.com/rancher/fleet", "defaultStatus": "unaffected"}], "references": [{"url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-44938"}, {"url": "https://github.com/advisories/GHSA-864g-863m-vcvq"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in Fleet's agent-side deployer, which did not filter security-sensitive keys from namespaceLabels in fleet.yaml (or BundleDeployment.spec.options.namespaceLabels) when applying them to the target namespace.\n\n\n\n\nAn attacker with git push access to a\n Fleet-monitored repository could overwrite Pod Security Standards (PSS)\n enforcement labels on a target namespace. This allows the attacker to \nweaken admission controls and deploy workloads that PSS policies would \notherwise block.", "supportingMedia": [{"type": "text/html", "value": "<p>A vulnerability has been identified in Fleet's agent-side deployer, which did not filter security-sensitive keys from <code>namespaceLabels</code> in <code>fleet.yaml</code> (or <code>BundleDeployment.spec.options.namespaceLabels</code>) when applying them to the target namespace.</p>\n<p>An attacker with <code>git push</code> access to a\n Fleet-monitored repository could overwrite Pod Security Standards (PSS)\n enforcement labels on a target namespace. This allows the attacker to \nweaken admission controls and deploy workloads that PSS policies would \notherwise block.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-522", "description": "CWE-522: Insufficiently Protected Credentials"}]}], "providerMetadata": {"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "shortName": "suse", "dateUpdated": "2026-07-07T13:05:03.344Z"}}}, "cveMetadata": {"cveId": "CVE-2026-44938", "state": "PUBLISHED", "dateUpdated": "2026-07-08T03:56:44.251Z", "dateReserved": "2026-05-08T12:29:48.967Z", "assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "datePublished": "2026-07-07T13:05:03.344Z", "assignerShortName": "suse"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageName": "github.com/rancher/fleet", "product": "Rancher", "vendor": "SUSE", "versions": [{"lessThan": "0.15.2", "status": "affected", "version": "0.15.0", "versionType": "semver"}, {"lessThan": "0.14.6", "status": "affected", "version": "0.14.0", "versionType": "semver"}, {"lessThan": "0.13.11", "status": "affected", "version": "0.13.0", "versionType": "semver"}, {"lessThan": "0.12.15", "status": "affected", "version": "0.12.0", "versionType": "semver"}]}], "source": "meissner@suse.de"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:suse:rancher_fleet:*:*:*:*:*:*:*:*", "matchCriteriaId": "8DE7373C-74E0-4B59-AF44-ECB9AC0130B9", "versionEndExcluding": "0.12.15", "versionStartIncluding": "0.12.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:suse:rancher_fleet:*:*:*:*:*:*:*:*", "matchCriteriaId": "D76AA40B-6291-46DC-BE27-BF4B8F6A8B23", "versionEndExcluding": "0.13.11", "versionStartIncluding": "0.13.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:suse:rancher_fleet:*:*:*:*:*:*:*:*", "matchCriteriaId": "F267A8DC-9A24-4A98-B765-CEEC0EBC2576", "versionEndExcluding": "0.14.6", "versionStartIncluding": "0.14.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:suse:rancher_fleet:*:*:*:*:*:*:*:*", "matchCriteriaId": "BE1A7C49-CBBF-45BA-91F1-D2DA940BE908", "versionEndExcluding": "0.15.2", "versionStartIncluding": "0.15.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in Fleet's agent-side deployer, which did not filter security-sensitive keys from namespaceLabels in fleet.yaml (or BundleDeployment.spec.options.namespaceLabels) when applying them to the target namespace.\n\n\n\n\nAn attacker with git push access to a\n Fleet-monitored repository could overwrite Pod Security Standards (PSS)\n enforcement labels on a target namespace. This allows the attacker to \nweaken admission controls and deploy workloads that PSS policies would \notherwise block."}, {"lang": "es", "value": "Una vulnerabilidad ha sido identificada en el desplegador del lado del agente de Fleet, que no filtraba claves sensibles a la seguridad de namespaceLabels en fleet.yaml (o BundleDeployment.spec.options.namespaceLabels) al aplicarlas al espacio de nombres objetivo.\n\nUn atacante con acceso de git push a un repositorio monitorizado por Fleet podr\u00eda sobrescribir las etiquetas de aplicaci\u00f3n de los Est\u00e1ndares de Seguridad de Pods (PSS) en un espacio de nombres objetivo. Esto permite al atacante debilitar los controles de admisi\u00f3n y desplegar cargas de trabajo que las pol\u00edticas PSS bloquear\u00edan de otro modo."}], "id": "CVE-2026-44938", "lastModified": "2026-10-25T20:10:00.147", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "meissner@suse.de", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44938", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-07-07T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-07-07T14:16:30.690", "references": [{"source": "meissner@suse.de", "tags": ["Permissions Required"], "url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-44938"}, {"source": "meissner@suse.de", "tags": ["Vendor Advisory"], "url": "https://github.com/advisories/GHSA-864g-863m-vcvq"}], "sourceIdentifier": "meissner@suse.de", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-522"}], "source": "meissner@suse.de", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.15.0,0.15.2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.14.0,0.14.6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.13.0,0.13.11)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.12.0,0.12.15)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Rancher", "source": "cna", "vendor": "SUSE"}, "product": "rancher", "vendor": "suse"}], "created": "2026-07-07T16:15:15.034864+00:00", "updated": "2026-08-01T17:45:04.933465+00:00", "vendors": ["suse", "suse$PRODUCT$rancher"]}