Dashboard / CVE-2026-41050

CVE-2026-41050

CRITICAL
INFO Priority: 0.04 BB Relevance: 70/100
Published: 2026-05-13 Modified: 2026-10-26 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Interaction Conf. Impact Integ. Impact Scope Change

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
S: Changed
C: High
I: High
A: High

Description

Fleet's Helm deployer did not fully apply ServiceAccount impersonation in two code paths, allowing a tenant with git push access to a Fleet-monitored repository to read secrets from any namespace on every downstream cluster targeted by their `GitRepo`.

Weakness Classification (1)

Affected Software (5)

VendorProductVersion
suse rancher_fleet 0.11.0 – 0.11.13
suse rancher_fleet 0.12.0 – 0.12.14
suse rancher_fleet 0.13.0 – 0.13.10
suse rancher_fleet 0.14.0 – 0.14.5
suse rancher_fleet 0.15.0 – 0.15.1

References & Advisories (2)

Bug Bounty Relevance

70 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

9.9 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

EPSS — Exploitation Probability

0.39%
Raw Score 0.003900
Percentile 33.1%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00390
2026-10-28
0.00390

Intelligence Sources

nvd ref →

External Links