← All Advisories

CVE-2026-93538

Last refreshed2026-10-12

Status: UPDATED  |  Advisory ID: CVE-2026-93538

Key Details

CVECVE-2026-93538
CVSS Score / Version
7.1 (High) / CVSS v3.1
Updated2026-10-07
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
CVSS Prose
attack vector is network; attack complexity is low; privileges required is low; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is low; availability impact is none.
Affected products
suse Rancher and suse rancher_fleet
Classified as
CWE-290 (Authentication Bypass by Spoofing)

Affected Products, Subsystems & Sectors

VendorProductAffected VersionsPatch Status
suseRancher
suserancher_fleet
SubsystemsGeneral OT
SectorsMultiple

What to Know

A cross-tenant authorization issue was discovered in SUSE Rancher Fleet. During agent-initiated cluster registration, cluster labels supplied by the registering agent, including labels in the reserved management.cattle.io/ namespace such as the cluster display name label, were applied to the resulting upstream Cluster object. Because Fleet resolves GitRepo and Bundle targets from those cluster labels, a party able to register a cluster into a Fleet workspace namespace shared with other tenants could cause its own cluster to satisfy targeting rules that administrators intended for a different cluster.

This affects SUSE Rancher Fleet 0.16 before 0.16.1, 0.15 before 0.15.6, 0.14 before 0.14.10, 0.13 before 0.13.15, 0.12 before 0.12.19 and older versions. (NVD)

What to Do

Monitor suse's web page for any future patch releases. See vendor advisory link below.

References

SourceReference
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-93538
CVEhttps://www.cve.org/CVERecord?id=CVE-2026-93538
Vendor advisoryhttps://github.com/rancher/fleet/security/advisories/GHSA-h9p5-fp5h-qpqr

About

OT-Advisories  ·  CVE  ·  NVD  ·  CVSS  ·  KEV  ·  EPSS  ·  CWE