The vulnerability CVE-2026-41050 in SUSE Rancher Fleet's Helm deployer is due to incomplete application of ServiceAccount impersonation in two code paths. This incorrect authorization (CWE-863) allows a tenant who has git push access to a Fleet-monitored repository to access secrets from any namespace on every downstream cluster targeted by their GitRepo. The issue affects Rancher versions 0.11.0 through 0.15.0. The CVSS 3.1 base score is 9.9, reflecting network attack vector, low attack complexity, privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability. No patch or official remediation level is currently documented, and no known exploits are reported in the wild.

An attacker with git push access to a Fleet-monitored repository can read sensitive secrets from any namespace on all downstream clusters targeted by their GitRepo. This compromises confidentiality and potentially integrity and availability of cluster resources. Given the critical CVSS score of 9.9, the impact is severe, allowing broad unauthorized access to sensitive data across multiple clusters.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is documented, organizations should restrict git push access to trusted users only and monitor for suspicious repository activity. Follow SUSE Rancher advisories closely for updates on patches or mitigations.