EUVD-2026-88296Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Description states no Kubernetes credentials are needed, so PR:N over the vendor's PR:L; impact limited to the pollingInterval field yields I:L/A:L and C:N.
Primary rating from Vendor (suse).
CVSS VectorVendor: suse
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was discovered in Fleet's Git webhook receiver (the gitjob webhook service). When a webhook secret is not configured, incoming webhook requests are accepted without verification, and processing a request can change the spec.pollingInterval field of a matching GitRepo resource in any namespace. A caller with network access to the webhook service and no Kubernetes credentials can therefore alter GitRepo configuration outside
the namespaces they are authorized for. This only affects SUSE Rancher Fleet 0.16 before 0.16.2, older versions are not affected.
AnalysisAI
Rancher Fleet 0.16.0 and 0.16.1 accept requests to the gitjob webhook receiver without verification whenever no webhook secret is configured, allowing any party with network reach to that endpoint to alter the spec.pollingInterval field of matching GitRepo resources in any namespace - including namespaces where the caller holds no Kubernetes credentials or RBAC. The assessed vector is unauthenticated remote (AV:N/PR:N), and impact is deliberately narrow: only a single configuration field can be changed, with no arbitrary spec edits, secret exposure, or workload execution and no confidentiality loss. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the specific non-default deployment state where the gitjob webhook receiver's webhook secret is NOT configured - with a secret set, requests are verified and the flaw does not apply. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but low-to-moderate priority issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Rancher Fleet to 0.16.2, the first release outside the affected 0.16 range, following the upgrade guidance in advisory GHSA-8vfv-33cg-g75q; no patched version other than 0.16.2 is warranted by the available data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Kubernetes
View allA critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.exter
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Rated critical severity (CVSS 9.9), this vulne
Unauthenticated remote attackers can trigger complete database overwrites, server-side file reads, and SSRF attacks agai
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
Fluentd configuration injection in the kube-logging Logging operator before 6.6.0 allows a namespace-scoped user who can
Kyverno Kubernetes policy engine prior to 1.x has a privilege escalation vulnerability (CVSS 9.9) allowing policy bypass
Same technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: ModerateShare
External POC / Exploit Code
Leaving vuln.today