CVE-2026-93540

Katalog CVE

CVSS 6.5 · Medium EPSS 0,17%

Kerentanan Incorrect Privilege Assignment pada suse rancher fleet. Skor CVSS 3.1 6.5 (Medium) menurut suse.de.

Deskripsi (NVD)

A privilege mismatch was found in Fleet. When a bundle requested namespace labels or annotations through the namespaceLabels and namespaceAnnotations options, the resulting namespace metadata update was not subject to the same authorization as the rest of the bundle's deployment. As a result, a bundle could change labels and annotations on a target namespace even when the identity it was pinned to was not authorized to modify that namespace. This affected SUSE Rancher Fleet 0.16 before 0.16.2, 0.15 before 0.15.7, 0.14 before 0.14.11, 0.13 before 0.13.16 and potentially older versions.

Rincian

Terbit di NVD

28 September 2026

Terakhir diubah

7 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber suse.de
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-266: Incorrect Privilege Assignment

EPSS (30 hari)

0,17% peluang dieksploitasi; lebih tinggi dari 6,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/rancher/fleet/security/advisories/GHSA-m93g-8438-2cgg advisory vendor