Vulnerability Details CVE-2026-41050
Fleet's Helm deployer did not fully apply ServiceAccount impersonation in two code paths, allowing a tenant with git push access to a Fleet-monitored repository to read secrets from any namespace on every downstream cluster targeted by their `GitRepo`.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 33.2%
CVSS Severity
CVSS v3 Score 9.9
References
Products affected by CVE-2026-41050
-
cpe:2.3:a:suse:rancher_fleet:*