CVE-2026-44936 rancher fleet vulnerability

Who is affected

How to fix it

Rancher Fleet is affected by CVE-2026-44936, a credential exposure risk. Missing filtering when the helmRepoURLRegex field isn't set on a GitRepo resource in SUSE Rancher Fleet's bundle reader in 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.15 forwards Helm authentication credentials (BasicAuth) to any URL specified in the helm.repo field of a fleet.yaml file, allowing attackers able to push to fleet monitored git repos to leak helm access credentials. The recommended remediation is to update to Rancher Fleet 0.15.2, 0.14.6, 0.13.11, 0.12.15, or a later fixed release for the deployed branch. Until the update is complete, set helmRepoURLRegex and restrict helm.repo destinations before processing monitored Git repositories, review logs, and reduce exposure of the affected package, route, provider, or service workflow.

1. Inventory every deployment, package, dependency, build runner, integration, route, service, and managed environment that uses Rancher Fleet.
2. Confirm the installed version/build and compare it with the affected versions listed in the source advisory and the source advisory for CVE-2026-44936.
3. Apply the vendor-supported fix: update to Rancher Fleet 0.15.2, 0.14.6, 0.13.11, 0.12.15, or a later fixed release for the deployed branch.
4. If the update cannot be applied immediately, set helmRepoURLRegex and restrict helm.repo destinations before processing monitored Git repositories; disable unnecessary public access, package-install paths, file processing, webhooks, message consumers, or high-risk integrations until patched.
5. Review application, CI/CD, package manager, container, reverse-proxy, WAF, authentication, route, and audit logs for activity related to CVE-2026-44936.
6. Rotate sessions, API tokens, package registry credentials, cloud credentials, webhook secrets, service credentials, and administrator passwords if logs or affected data indicate compromise, credential exposure, or unauthorized access.
7. Clear caches, restart affected services, rebuild affected containers or build agents when appropriate, and remove temporary files, malicious artifacts, stored payloads, or unsafe configuration created during exploitation attempts.

Verify the fix

• Confirm Rancher Fleet now reports Rancher Fleet 0.15.2, 0.14.6, 0.13.11, 0.12.15, or a later fixed release for the deployed branch or a later vendor-supported fixed release/build for the deployed branch.
• Verify the affected workflow no longer allows the behavior described in CVE-2026-44936, using a safe regression test, dependency inventory, or vendor validation method.
• Review logs after remediation for continued exploit attempts, denial-of-service symptoms, suspicious redirects, unauthorized requests, path traversal, header manipulation, credential exposure, or configuration changes.
• Rerun a Fixnx scan and any product-specific scanner, package audit, dependency check, route regression test, or integration test relevant to the affected service.
• Document affected assets, fixed versions, mitigation decisions, validation evidence, and any cleanup, rebuild, or credential rotation performed.

Trusted references

FAQ