This vulnerability (CWE-918) affects SUSE Rancher Fleet's handling of unauthenticated webhook requests in versions prior to 0.15.2, 0.14.6, 0.13.11, and 0.12.5. Remote attackers may exploit this SSRF flaw to forge webhook requests, potentially leading to denial of service conditions or downgrade attacks targeting other repositories managed by the system. The CVSS 4.0 base score is 8.3, indicating high severity, with network attack vector, high attack complexity, and no privileges or user interaction required. No official patch or remediation level has been published yet, and no known exploits are reported in the wild.

Successful exploitation can allow remote attackers to forge webhook requests without authentication, leading to denial of service or downgrade attacks on repositories managed by Rancher Fleet. This could disrupt normal operations and compromise the integrity of repository updates.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor SUSE's advisories for updates. Until a patch is available, consider restricting access to webhook endpoints and implementing network-level controls to limit exposure.