This vulnerability (CWE-306) in SUSE Rancher FleetWorkspace admission path allows unauthenticated attackers with network access to the in-cluster rancher-webhook service to submit specially crafted admission payloads. These payloads can cause the creation of Kubernetes workspace-related objects with attacker-controlled identity data. The affected versions include 0.7.0 through versions prior to 0.7.10, 0.8.0 through versions prior to 0.8.7, 0.9.0 through versions prior to 0.9.6, and 0.10.0 through versions prior to 0.10.7. The vulnerability is classified as high severity with a CVSS 4.0 score of 7.0. No official patch or remediation level is stated in the vendor advisory, and no known exploits in the wild have been reported.

An unauthenticated attacker with network access to the in-cluster rancher-webhook service can exploit this vulnerability to create Kubernetes workspace-related objects with attacker-chosen identity data. This could lead to unauthorized manipulation of Kubernetes objects within the Rancher environment, potentially impacting cluster integrity and security. The vulnerability does not require user interaction and has low attack complexity, increasing the risk of exploitation in accessible environments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided in the available data, users should monitor SUSE Rancher's advisories for updates. Until a patch is available, restrict network access to the in-cluster rancher-webhook service to trusted entities only to reduce exposure. Avoid exposing the webhook service to untrusted networks.