The vulnerability in SUSE Rancher Fleet's agent-side deployer involves insufficient filtering of security-sensitive keys from namespaceLabels when applying them to target namespaces. An attacker with git push access to a Fleet-monitored repository can exploit this to overwrite Pod Security Standards enforcement labels, thereby weakening admission controls. This enables deployment of workloads that would otherwise be blocked by PSS policies, potentially compromising cluster security. The CVSS 3.1 score is 8.8 (high), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality, integrity, and availability. Affected versions include 0.12.0 through 0.15.1 (with specific subversions noted). No official patch or remediation level is currently indicated.

An attacker with git push access to a Fleet-monitored repository can overwrite Pod Security Standards enforcement labels on target namespaces. This weakens admission controls, allowing deployment of workloads that PSS policies would normally block. The impact includes potential compromise of confidentiality, integrity, and availability of workloads and namespaces within the Kubernetes cluster managed by Rancher Fleet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or remediation level has been published by SUSE at this time. Until a patch is available, restrict git push access to trusted users only and monitor repository changes for unauthorized modifications to namespaceLabels in fleet.yaml or BundleDeployment specifications.