CVE-2026-75036: CWE-918 Server-Side request forgery (SSRF) in SUSE Fleet
Description
A security vulnerability was discovered in Fleet's Helm template preprocessing where templates evaluated by the Fleet controller could reach network resources outside the management cluster. A user who can supply bundle content to a repository referenced by a `GitRepo` resource can cause the Fleet controller to: - Disclose cluster metadata available to the templating context. - Reveal information about hosts reachable from the controller's network position. Because the disclosure channel is name resolution, it may remain effective in environments where outbound traffic is otherwise restricted. The disclosed information is limited to values exposed to the Fleet templating context and to name resolution results. Integrity and availability of managed clusters are not affected. This issue affects Fleet: from 0.12.0 before 0.12.19, from 0.13.0 before 0.13.15, from 0.14.0 before 0.14.10, from 0.15.0 before 0.15.6, and from 0.16.0 before 0.16.1.
CVSS v4.0
Score 5.3medium
Affected software
SUSE
Fleet
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in SUSE Fleet arises from the Helm template preprocessing mechanism where templates evaluated by the Fleet controller can reach network resources outside the management cluster. An attacker able to supply bundle content to a repository referenced by a GitRepo resource can exploit this to disclose cluster metadata and host information accessible from the controller's network position. The data leakage channel is via DNS name resolution, which can be effective even in restricted outbound traffic environments. The disclosed information is limited to what is exposed to the templating context and DNS results. The flaw does not affect cluster integrity or availability. Affected versions include 0.12.0 before 0.12.19, 0.13.0 before 0.13.15, 0.14.0 before 0.14.10, 0.15.0 before 0.15.6, and 0.16.0 before 0.16.1.
Potential Impact
The vulnerability leads to information disclosure of cluster metadata and network host information reachable from the Fleet controller. This leakage occurs through DNS name resolution and may bypass outbound traffic restrictions. There is no impact on the integrity or availability of the managed clusters. No known exploits in the wild have been reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Users should monitor SUSE advisories for updates and apply patches once available. Until then, restrict access to bundle content supply mechanisms and GitRepo resources to trusted users to reduce risk.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- suse
- Date Reserved
- 2026-08-17T15:22:54.444Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a9990d2acd9273b491c1d67
Added to database: 09/03/2026, 15:22:58 UTC
Last enriched: 09/07/2026, 11:29:46 UTC
Last updated: 10/17/2026, 06:48:20 UTC
Views: 36
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.