CVE-2026-44935

The 'valuesFrom' mechanism in Helm Deployer allows pointing to external sources of configuration values. Due to insufficient validation of these references, a person authenticated as the owner of one tenant can construct a reference pointing to resources (Fleet credentials) belonging to another tenant. The vulnerability thus enables circumventing tenant isolation boundaries without requiring administrative privileges to the system.

An attacker who is an authenticated user of one tenant can gain unauthorized access to Fleet credentials of other tenants, leading to violations of confidentiality, integrity, and availability of resources in a multi-tenant environment.

Update SUSE Rancher Fleet to version: 0.12.15 or later (0.12 branch), 0.13.11 or later (0.13 branch), 0.14.6 or later (0.14 branch), 0.15.2 or later (0.15 branch). Details available in the official vendor security advisory: https://github.com/rancher/fleet/security/advisories/GHSA-xr65-5cpm-g36x

SUSE Rancher Fleet in versions: 0.12 before 0.12.15, 0.13 before 0.13.11, 0.14 before 0.14.6, and 0.15 before 0.15.2.