CVE-2026-93540

A privilege mismatch was found in Fleet

Risk score: 40/100
CVSS: 6.5 v3.1
Exploit chance (30 days): 0.2%
Published: 28 Sep 2026

Open in the live forecast Today's forecast

What to know

What it is: A privilege mismatch was found in Fleet. When a bundle requested namespace labels or annotations through the namespaceLabels and namespaceAnnotations options, the resulting namespace metadata update was not subject to the same authorization as the rest of the bundle's deployment. As a result, a bundle could change lab…
Affected: Suse Rancher Fleet before 0.16.2, 0.15, 0.15.7, 0.14, 0.14.11, 0.13, 0.13.16
Fix: Upgrade Suse Rancher Fleet to 0.16.2, 0.15, 0.15.7, 0.14, 0.14.11, 0.13 or 0.13.16 (whichever matches your release line), or later.
Exploitation: No known exploitation

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Suse Rancher Fleet: Yellow, plan it in. A vulnerability has been identified within Rancher Manager where the Fleet agent wrote resources to downstream clusters using its own cluster-admin credentials instead of the ServiceAccount pinned to the deployment. It affects multi-tenancy environments where different tenants share the same downstream clusters, for e…

The flaws

CVE-2026-93540: A privilege mismatch was found in Fleet (CVSS 6.5 · EPSS 0%)
CVE-2026-88808: A vulnerability has been identified within Rancher Manager where the Fleet agent wrote resources to… (CVSS 8.8 · EPSS 0%)
CVE-2026-93538: Authorisation bypass (CVSS 7.1 · EPSS 0%)
CVE-2026-93537: Path traversal (CVSS 6.5 · EPSS 0%)

The fix

Upgrade Suse Rancher Fleet: 0.16.2 · 0.15 · 0.15.7 · 0.14 · 0.14.11 · 0.13 or later on your release line

Who is exposed: Suse Rancher Fleet before 0.16.2, 0.15, 0.15.7, 0.14, 0.14.11

Where it stands

No known exploitation

Connects to

Same weakness: CWE-266 (CWE-266). 73 other warnings in 30 days
Same product: Earlier Suse Rancher Fleet warnings. 1 in the last 90 days

Why it is Yellow

CVSS 6.5 medium

References

https://github.com/rancher/fleet/security/advisories/GHSA-m93g-8438-2cgg

Original description

A privilege mismatch was found in Fleet. When a bundle requested namespace labels or annotations through the namespaceLabels and namespaceAnnotations options, the resulting namespace metadata update was not subject to the same authorization as the rest of the bundle's deployment. As a result, a bundle could change labels and annotations on a target namespace even when the identity it was pinned to was not authorized to modify that namespace. This affected SUSE Rancher Fleet 0.16 before 0.16.2, 0.15 before 0.15.7, 0.14 before 0.14.11, 0.13 before 0.13.16 and potentially older versions.

Last activity 28 Sep 2026. Patch Forecast updates every hour.