Skip to main content

Rancher Fleet CVE-2026-75036

| EUVDEUVD-2026-70520 MEDIUM
Server-Side Request Forgery (SSRF) (CWE-918)
2026-09-03 suse
SSRF Fleet Suse
5.3
CVSS 4.0 · Vendor: suse
Share

Severity by source

Vendor (suse) PRIMARY
5.3 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
4.3 MEDIUM

PR:L because exploitation requires GitRepo repository write access; C:L reflects limited templating-context metadata and DNS enumeration only; no integrity or availability impact confirmed by advisory.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative

Primary rating from Vendor (suse).

CVSS VectorVendor: suse

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

2
Patch available
Sep 03, 2026 - 17:01 EUVD
Analysis Generated
Sep 03, 2026 - 16:02 vuln.today

DescriptionCVE.org

A security vulnerability was discovered in Fleet's Helm template preprocessing where templates evaluated by the Fleet controller could reach network resources outside the management cluster. A user who can supply bundle content to a repository referenced by a GitRepo resource can cause the Fleet controller to:

  • Disclose cluster metadata available to the templating context.
  • Reveal information about hosts reachable from the controller's network position.

Because the disclosure channel is name resolution, it may remain effective in environments where outbound traffic is otherwise restricted. The disclosed information is limited to values exposed to the Fleet templating context and to name resolution results. Integrity and availability of managed clusters are not affected.

This issue affects Fleet: from 0.12.0 before 0.12.19, from 0.13.0 before 0.13.15, from 0.14.0 before 0.14.10, from 0.15.0 before 0.15.6, and from 0.16.0 before 0.16.1.

AnalysisAI

Fleet controller's Helm template preprocessing exposes cluster metadata and internal DNS topology to any user with write access to a GitRepo-tracked repository, via a server-side request forgery path that abuses name resolution. Affected releases span all active branches from 0.12.0 through 0.16.0, with patched builds released across each branch. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that the attacker hold write access to a Git repository referenced by a Fleet GitRepo resource - specifically, the ability to commit Helm bundle content that the Fleet controller will process during reconciliation. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 5.3 (Medium) is appropriate and well-calibrated: PR:L correctly captures that exploitation requires existing GitRepo repository write access rather than unauthenticated network reachability, and the VC:L/VI:N/VA:N vector reflects a bounded information-disclosure outcome with no path to cluster compromise. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Upgrade Fleet to the patched release corresponding to the deployed branch: 0.12.19, 0.13.15, 0.14.10, 0.15.6, or 0.16.1, per the Rancher security advisory at https://github.com/rancher/fleet/security/advisories/GHSA-x9m6-xcjr-hpjp. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Fleet

View all
CVE-2026-23518 CRITICAL
9.8 Jan 21

Fleet device management software has a signature verification bypass that allows attackers to install malicious firmware
CVE-2020-26276 CRITICAL
9.8 Dec 17

Fleet is an open source osquery manager. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
CVE-2026-26186 HIGH
8.8 Feb 26

SQL injection in Fleet device management software before version 4.80.1 allows authenticated users to manipulate the ord
CVE-2026-23517 HIGH
8.1 Jan 21

Fleet device management software versions prior to 4.78.3 suffer from broken access control that permits any authenticat
CVE-2022-24841 HIGH
8.1 Apr 18

fleetdm/fleet is an open source device management, built on osquery. Rated high severity (CVSS 8.1), this vulnerability

CVE-2019-1020009 HIGH
7.5 Jul 29

Fleet before 2.1.2 allows exposure of SMTP credentials. Rated high severity (CVSS 7.5), this vulnerability is remotely e
CVE-2026-34388 MEDIUM
6.6 Mar 27

Denial-of-service vulnerability in Fleet device management software prior to version 4.81.0 allows authenticated hosts t
CVE-2026-34391 MEDIUM
6.6 Mar 27

Fleet device management software versions prior to 4.81.1 allow malicious enrolled Windows devices to access Mobile Devi
CVE-2026-27465 MEDIUM
6.5 Feb 26

Fleet versions up to 4.80.1 contains a vulnerability that allows attackers to unauthorized access to Google Calendar res
CVE-2026-25963 MEDIUM
6.5 Feb 26

Fleet device management software versions before 4.80.1 contain an authorization bypass in the certificate template dele
CVE-2026-34386 MEDIUM
6.3 Mar 27

SQL injection in Fleet device management software versions prior to 4.81.0 allows authenticated Team Admin or Global Adm
CVE-2026-34385 MEDIUM
6.2 Mar 27

SQL injection in Fleet's Apple MDM profile delivery pipeline before version 4.81.0 allows authenticated attackers with v

Same weakness CWE-918 – Server-Side Request Forgery (SSRF)

View all
CVE-2021-34473 CRITICAL POC
9.1
CVE-2021-26855 CRITICAL POC
9.1
CVE-2021-21985 CRITICAL POC
9.8
CVE-2022-41040 HIGH POC
8.8
CVE-2024-21893 HIGH POC
8.2
CVE-2021-40438 CRITICAL POC
9.0
CVE-2021-21975 HIGH POC
7.5
CVE-2023-48022 CRITICAL POC
9.8

Same technique SSRF

View all
CVE-2021-34473 CRITICAL POC
9.1
CVE-2021-26855 CRITICAL POC
9.1
CVE-2021-21985 CRITICAL POC
9.8
CVE-2024-21893 HIGH POC
8.2
CVE-2021-40438 CRITICAL POC
9.0
CVE-2021-21975 HIGH POC
7.5
CVE-2016-3718 MEDIUM POC
5.5
CVE-2026-15409 CRITICAL POC
10.0

Vendor StatusVendor

SUSE

Severity: Moderate

Share

CVE-2026-75036 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy