This vulnerability arises from improper validation of the "valuesFrom" references in the Helm Deployer component of SUSE Rancher Fleet. Specifically, versions 0.12 before 0.12.15, 0.13 before 0.13.11, 0.14 before 0.14.6, and 0.15 before 0.15.2 are affected. Exploiting this flaw, a tenant owner could access fleet credentials belonging to other tenants, leading to a breach of tenant isolation. The CVSS 3.1 vector indicates network attack vector, low attack complexity, required privileges of low, no user interaction, scope changed, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows a tenant owner to access sensitive fleet credentials of other tenants, compromising confidentiality and potentially enabling further unauthorized actions. The vulnerability affects tenant isolation, which is critical in multi-tenant environments. The high CVSS score (9.9) reflects the critical nature of this impact.

No official patch or remediation level is currently confirmed for this vulnerability. Patch status is not yet confirmed — check the SUSE vendor advisory for current remediation guidance. Until a fix is available, restrict tenant permissions and monitor for suspicious activity related to Helm Deployer usage.