CVE-2026-93537: CWE-23 Relative path traversal in SUSE Rancher
A user who can supply bundle content to a repository referenced by a GitRepo resource, for example through Git push access, or through permission to create or modify a GitRepo, can cause SUSE Rancher Fleet to read files from the filesystem of the environment that processes the bundle and include their contents in the generated Bundle resource. This can expose configuration or credential material that the user has no Kubernetes RBAC permission to read, including Helm registry credentials made available to the bundle-processing job when per-path Helm credentials are configured. This affects Fleet 0.16 before 0.16.2, 0.15 before 0.15.7, 0.14 before 0.14.11, 0.13 before 0.13.16, 0.12 before 0.12.20 and potentially older unsupported versions.
AI Analysis
Technical Summary
This vulnerability arises when a user who can supply bundle content to a repository referenced by a GitRepo resource—via Git push access or permission to create/modify a GitRepo—can cause SUSE Rancher Fleet to read files from the processing environment's filesystem. The contents of these files are then included in the generated Bundle resource, potentially exposing sensitive information such as configuration files or Helm registry credentials that the user is not authorized to access under Kubernetes RBAC. The issue is a CWE-23 relative path traversal affecting Fleet versions 0.12 before 0.12.20, 0.13 before 0.13.16, 0.14 before 0.14.11, 0.15 before 0.15.7, and 0.16 before 0.16.2.
Potential Impact
An attacker with GitRepo repository access or permissions to create/modify GitRepo resources can exploit this vulnerability to read arbitrary files on the system processing the bundle. This can lead to exposure of sensitive configuration or credential material, including Helm registry credentials, bypassing Kubernetes RBAC restrictions. The vulnerability has a CVSS 3.1 base score of 6.5 (medium severity), indicating a significant confidentiality impact without integrity or availability impact.
Mitigation Recommendations
The vulnerability is fixed in Fleet versions 0.12.20, 0.13.16, 0.14.11, 0.15.7, and 0.16.2. Users should upgrade to these or later versions to remediate the issue. No vendor advisory content was provided to indicate alternative mitigations or temporary fixes. Patch status is confirmed by the version ranges provided. No cloud service remediation applies as this is not a cloud service.
CVE-2026-93537: CWE-23 Relative path traversal in SUSE Rancher
Description
A user who can supply bundle content to a repository referenced by a GitRepo resource, for example through Git push access, or through permission to create or modify a GitRepo, can cause SUSE Rancher Fleet to read files from the filesystem of the environment that processes the bundle and include their contents in the generated Bundle resource. This can expose configuration or credential material that the user has no Kubernetes RBAC permission to read, including Helm registry credentials made available to the bundle-processing job when per-path Helm credentials are configured. This affects Fleet 0.16 before 0.16.2, 0.15 before 0.15.7, 0.14 before 0.14.11, 0.13 before 0.13.16, 0.12 before 0.12.20 and potentially older unsupported versions.
CVSS v3.1
Score 6.5medium
Affected software
SUSE
Rancher
pkg:github/FleetRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability arises when a user who can supply bundle content to a repository referenced by a GitRepo resource—via Git push access or permission to create/modify a GitRepo—can cause SUSE Rancher Fleet to read files from the processing environment's filesystem. The contents of these files are then included in the generated Bundle resource, potentially exposing sensitive information such as configuration files or Helm registry credentials that the user is not authorized to access under Kubernetes RBAC. The issue is a CWE-23 relative path traversal affecting Fleet versions 0.12 before 0.12.20, 0.13 before 0.13.16, 0.14 before 0.14.11, 0.15 before 0.15.7, and 0.16 before 0.16.2.
Potential Impact
An attacker with GitRepo repository access or permissions to create/modify GitRepo resources can exploit this vulnerability to read arbitrary files on the system processing the bundle. This can lead to exposure of sensitive configuration or credential material, including Helm registry credentials, bypassing Kubernetes RBAC restrictions. The vulnerability has a CVSS 3.1 base score of 6.5 (medium severity), indicating a significant confidentiality impact without integrity or availability impact.
Mitigation Recommendations
The vulnerability is fixed in Fleet versions 0.12.20, 0.13.16, 0.14.11, 0.15.7, and 0.16.2. Users should upgrade to these or later versions to remediate the issue. No vendor advisory content was provided to indicate alternative mitigations or temporary fixes. Patch status is confirmed by the version ranges provided. No cloud service remediation applies as this is not a cloud service.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- suse
- Date Reserved
- 2026-09-18T09:08:10.294Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aba7026f7a7c54106c00b44
Added to database: 09/28/2026, 13:48:22 UTC
Last enriched: 09/28/2026, 14:03:24 UTC
Last updated: 09/29/2026, 01:57:22 UTC
Views: 15
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.