Vulnerability Details CVE-2026-44938
A vulnerability has been identified in Fleet's agent-side deployer, which did not filter security-sensitive keys from namespaceLabels in fleet.yaml (or BundleDeployment.spec.options.namespaceLabels) when applying them to the target namespace.
An attacker with git push access to a
Fleet-monitored repository could overwrite Pod Security Standards (PSS)
enforcement labels on a target namespace. This allows the attacker to
weaken admission controls and deploy workloads that PSS policies would
otherwise block.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 38.5%
CVSS Severity
CVSS v3 Score 8.8
References
Products affected by CVE-2026-44938
-
cpe:2.3:a:suse:rancher_fleet:0.12.0
-
cpe:2.3:a:suse:rancher_fleet:0.12.1
-
cpe:2.3:a:suse:rancher_fleet:0.12.10
-
cpe:2.3:a:suse:rancher_fleet:0.12.11
-
cpe:2.3:a:suse:rancher_fleet:0.12.12
-
cpe:2.3:a:suse:rancher_fleet:0.12.13
-
cpe:2.3:a:suse:rancher_fleet:0.12.14
-
cpe:2.3:a:suse:rancher_fleet:0.12.2
-
cpe:2.3:a:suse:rancher_fleet:0.12.3
-
cpe:2.3:a:suse:rancher_fleet:0.12.4
-
cpe:2.3:a:suse:rancher_fleet:0.12.5
-
cpe:2.3:a:suse:rancher_fleet:0.12.6
-
cpe:2.3:a:suse:rancher_fleet:0.12.7
-
cpe:2.3:a:suse:rancher_fleet:0.12.8
-
cpe:2.3:a:suse:rancher_fleet:0.12.9
-
cpe:2.3:a:suse:rancher_fleet:0.13.0
-
cpe:2.3:a:suse:rancher_fleet:0.13.1
-
cpe:2.3:a:suse:rancher_fleet:0.13.10
-
cpe:2.3:a:suse:rancher_fleet:0.13.2
-
cpe:2.3:a:suse:rancher_fleet:0.13.3
-
cpe:2.3:a:suse:rancher_fleet:0.13.4
-
cpe:2.3:a:suse:rancher_fleet:0.13.5
-
cpe:2.3:a:suse:rancher_fleet:0.13.6
-
cpe:2.3:a:suse:rancher_fleet:0.13.7
-
cpe:2.3:a:suse:rancher_fleet:0.13.8
-
cpe:2.3:a:suse:rancher_fleet:0.13.9
-
cpe:2.3:a:suse:rancher_fleet:0.14.0
-
cpe:2.3:a:suse:rancher_fleet:0.14.1
-
cpe:2.3:a:suse:rancher_fleet:0.14.2
-
cpe:2.3:a:suse:rancher_fleet:0.14.3
-
cpe:2.3:a:suse:rancher_fleet:0.14.4
-
cpe:2.3:a:suse:rancher_fleet:0.14.5
-
cpe:2.3:a:suse:rancher_fleet:0.15.0
-
cpe:2.3:a:suse:rancher_fleet:0.15.1