This vulnerability in SUSE Rancher Fleet's bundle reader arises from insufficient filtering of URLs when the helmRepoURLRegex field is unset on a GitRepo resource. Specifically, in versions 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11, and 0.12 before 0.12.15, the system forwards Helm BasicAuth credentials to any URL specified in the helm.repo field of a fleet.yaml file. This enables an attacker who can push to the monitored git repositories to cause leakage of Helm authentication credentials via SSRF.

An attacker with push access to fleet monitored git repositories can exploit this vulnerability to leak Helm authentication credentials by causing the system to forward these credentials to arbitrary URLs. This compromises the confidentiality of Helm credentials but does not affect integrity or availability. The CVSS score of 5.0 (medium severity) reflects the network attack vector, low attack complexity, and limited privileges required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict push access to fleet monitored git repositories to trusted users only and review helmRepoURLRegex configurations to ensure proper filtering of URLs.