EUVD-2026-88287Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-reachable low-complexity attack needing a low-privilege git/GitRepo foothold (PR:L); confidentiality-only credential/config disclosure, no integrity or availability impact, same-system scope.
Primary rating from Vendor (suse).
CVSS VectorVendor: suse
Lifecycle Timeline
3DescriptionCVE.org
A user who can supply bundle content to a repository referenced by a GitRepo resource, for example through Git push access, or through permission to create or modify a GitRepo, can cause SUSE Rancher Fleet to read files from the filesystem of the environment that processes the bundle and include their contents in the generated Bundle resource. This can expose configuration or credential material that the user has no Kubernetes RBAC permission to read, including Helm registry credentials made available to the bundle-processing job when per-path Helm credentials are configured. This affects Fleet 0.16 before 0.16.2, 0.15 before 0.15.7, 0.14 before 0.14.11, 0.13 before 0.13.16, 0.12 before 0.12.20 and potentially older unsupported versions.
AnalysisAI
Relative path traversal (CWE-23) in SUSE Rancher Fleet allows an authenticated attacker with either Git push access to a repository referenced by a GitRepo resource or Kubernetes RBAC permission to create or modify a GitRepo (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) to read files from the filesystem of the bundle-processing environment and have their contents emitted into the generated Bundle resource. The most valuable target is Helm registry credential material that Fleet makes available to the bundle-processing job when per-path Helm credentials are configured, letting the attacker exfiltrate secrets they have no Kubernetes RBAC permission to read. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated actor holding one of two footholds: write/push access to a Git repository referenced by a Fleet GitRepo resource, OR Kubernetes RBAC permission to create or modify a GitRepo resource (PR:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a moderate, credible risk best characterized as a privilege-boundary-crossing information disclosure rather than a high-urgency emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patches are available: upgrade Fleet to 0.16.2, 0.15.7, 0.14.11, 0.13.16 or 0.12.20 depending on the maintenance line in use, per advisory https://github.com/rancher/fleet/security/advisories/GHSA-wpfm-r97v-3j4h. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Kubernetes
View allA critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.exter
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Rated critical severity (CVSS 9.9), this vulne
Unauthenticated remote attackers can trigger complete database overwrites, server-side file reads, and SSRF attacks agai
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
Fluentd configuration injection in the kube-logging Logging operator before 6.6.0 allows a namespace-scoped user who can
Kyverno Kubernetes policy engine prior to 1.x has a privilege escalation vulnerability (CVSS 9.9) allowing policy bypass
Same weakness CWE-23 – Relative Path Traversal
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: ModerateShare
External POC / Exploit Code
Leaving vuln.today