HIGH7.7Go
GHSA-6h9x-9j5v-7w9h· CVE-2024-52284, GO-2025-3927Rancher Fleet Helm Values are stored inside BundleDeployment in plain text
Modified: 9/8/2025
package
Go/github.com/rancher/fleet
pkg:go/github.com/rancher/fleet
CRITICAL9.9Go
GHSA-765j-qfrp-hm3j· CVE-2026-41050, GO-2026-5207Fleet: Helm impersonation bypass of `RESTClientGetter` retains `cluster-admin` during template rendering
Modified: 6/25/2026
HIGH8.8Go
GHSA-864g-863m-vcvq· CVE-2026-44938, GO-2026-5871Fleet has PSS Bypass through addLabelsFromOptions in Fleet Agent
Modified: 7/7/2026
MEDIUM5.0Go
GHSA-hx4v-cxpf-vh8m· CVE-2026-44936, GO-2026-5873Rancher Fleet has SSRF in Bundle Reader via Unvalidated Helm Repository URL in fleet.yaml
Modified: 7/7/2026
HIGH7.5Go
GHSA-jmf4-m7j9-g72r· CVE-2026-44937, GO-2026-5874Rancher Fleet has Unauthenticated Webhook: Regex Injection via Unsanitized Repository URL Components
Modified: 7/7/2026
MEDIUM6.3Go
GHSA-xgpc-q899-67p8· CVE-2025-23390, GO-2025-3649Fleet doesn’t validate a server’s certificate when connecting through SSH
Modified: 5/5/2025
CRITICAL9.9Go
GHSA-xr65-5cpm-g36x· CVE-2026-44935, GO-2026-5877Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm Deployer
Modified: 7/7/2026
—Go
GO-2025-3649· CVE-2025-23390, GHSA-xgpc-q899-67p8Fleet doesn’t validate a server’s certificate when connecting through SSH in github.com/rancher/fleet
Modified: 3/3/2026
—Go
GO-2025-3927· CVE-2024-52284, GHSA-6h9x-9j5v-7w9hRancher Fleet Helm Values are stored inside BundleDeployment in plain text in github.com/rancher/fleet
Modified: 3/3/2026
—Go
GO-2026-5207· CVE-2026-41050, GHSA-765j-qfrp-hm3jFleet: Helm impersonation bypass of `RESTClientGetter` retains `cluster-admin` during template rendering in github.com/rancher/fleet
Modified: 6/25/2026
—Go
GO-2026-5871· CVE-2026-44938, GHSA-864g-863m-vcvqFleet has PSS Bypass through addLabelsFromOptions in Fleet Agent in github.com/rancher/fleet
Modified: 7/7/2026
—Go
GO-2026-5873· CVE-2026-44936, GHSA-hx4v-cxpf-vh8mRancher Fleet has SSRF in Bundle Reader via Unvalidated Helm Repository URL in fleet.yaml in github.com/rancher/fleet
Modified: 7/7/2026
—Go
GO-2026-5874· CVE-2026-44937, GHSA-jmf4-m7j9-g72rRancher Fleet has Unauthenticated Webhook: Regex Injection via Unsanitized Repository URL Components in github.com/rancher/fleet
Modified: 7/7/2026
—Go
GO-2026-5877· CVE-2026-44935, GHSA-xr65-5cpm-g36xRancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm Deployer in github.com/rancher/fleet
Modified: 7/7/2026