EUVD-2026-40348Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Authenticated network path traversal causing availability-only impact; PR:L required because exploitation demands valid Fleet API credentials.
Primary rating from Vendor (suse).
CVSS VectorVendor: suse
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
A path traversal vulnerability was found in Fleet's ImageScan subsystem in Rancher Fleet 0.12.0 up to 0.12.16, 0.13.0 up to 0.13.12, 0.14.0 up to 0.14.7 and 0.15.0 up to 0.15.3 could be used to traverse outside of the intended directory, causing a denial of service.
AnalysisAI
Path traversal in Rancher Fleet's ImageScan subsystem (CWE-23) allows authenticated remote attackers to escape intended directory boundaries and trigger denial of service across four active release branches (0.12.x through 0.15.x). The flaw appears to have been introduced in the 0.12.0 series and persisted undetected through at least sixteen subsequent patch releases, indicating the ImageScan component lacked adequate path sanitization for an extended period. No public exploit code or active exploitation has been identified; the CVSS 4.0 vector (PR:L) confirms exploitation requires authenticated access, materially limiting opportunistic attack surface.
Technical ContextAI
Rancher Fleet is SUSE's GitOps-based continuous delivery engine for Kubernetes, designed to manage and deploy workloads across large multi-cluster environments. The ImageScan subsystem is a Fleet component responsible for scanning container images as part of the GitOps pipeline. CWE-23 (Relative Path Traversal) describes insufficient sanitization of user-supplied path components - an attacker supplies sequences such as '../' that the application fails to normalize or reject, allowing file system operations to target paths outside the intended working directory. The affected CPE is cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*. Per the CVSS 4.0 metrics, exploitation yields only availability impact (VA:L) with no confidentiality or integrity consequence, suggesting the traversal causes the ImageScan process to reference invalid or protected paths that crash or hang the subsystem rather than exfiltrate data.
RemediationAI
Consult the Rancher Fleet security advisory at https://github.com/rancher/fleet/security/advisories/GHSA-c45g-6c2c-rj3p for the exact patched release versions - specific fix version numbers are not independently confirmed from available input data and should not be assumed. Operators should upgrade to the first patched release in their respective active branch (the release immediately following 0.12.16, 0.13.12, 0.14.7, or 0.15.3 as published by SUSE). As a compensating control prior to patching, consider disabling Fleet's ImageScan feature if container image scanning is not operationally required - this eliminates the attack surface entirely but removes image scan capabilities from the pipeline. Additionally, restrict Fleet API access to only trusted, explicitly authorized service accounts and principals to reduce the pool of credential holders who could trigger the flaw. Monitor Fleet controller logs for anomalous path references or ImageScan process crashes as a detection measure.
An Improper Authorization vulnerability in SUSE Rancher, allows any user who has permissions to create/edit cluster role
A Cleartext Transmission of Sensitive Information vulnerability in SUSE Rancher, Rancher allows attackers on the network
Improper Privilege Management vulnerability in SUSE Rancher allows Privilege Escalation. Rated critical severity (CVSS 9
A Improper Access Control vulnerability in Rancher, allows users in the cluster to make request to cloud providers by cr
An issue was discovered that affects the following versions of Rancher: v2.0.0 through v2.0.13, v2.1.0 through v2.1.8, a
Command injection in Rancher Manager’s cluster import endpoint enables remote attackers to deploy malicious containers o
SAML assertion replay in Rancher's Assertion Consumer Service (ACS) handler lets a person-in-the-middle who captures a v
Privilege escalation in SUSE Rancher (Kubernetes management platform) allows a user holding the Project Owner role to im
Rancher Labs rancher server 1.2.0+ is vulnerable to authenticated users disabling access control via an API call. Rated
Privilege escalation in Rancher 2.13 (before 2.13.6) and 2.14 (before 2.14.2) lets any authenticated user gain principal
Cleartext registration token exposure in Rancher allows a low-privileged user to obtain perpetually valid cluster join t
A Improper Privilege Management vulnerability in SUSE Rancher causes permission changes in Azure AD not to be reflected
Same weakness CWE-23 – Relative Path Traversal
View allSame technique Path Traversal
View allVendor StatusVendor
SUSE
Severity: ModerateShare
External POC / Exploit Code
Leaving vuln.today