Back to overview

CVE-2026-44936

MEDIUM
5.0
CVSS 3.1
Description
Missing filtering when the helmRepoURLRegex field isn't set on a GitRepo resource in SUSE Rancher Fleet's bundle reader in 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.15 forwards Helm authentication credentials (BasicAuth) to any URL specified in the helm.repo field of a fleet.yaml file, allowing attackers able to push to fleet monitored git repos to leak helm access credentials.

Metadata

CVE ID
CVE-2026-44936
State
PUBLISHED
Assigner
suse
Reserved
2026-05-08 12:29 UTC
Published
2026-07-06 09:30 UTC
Last updated
2026-07-06 12:47 UTC
Primary CWE
CWE-918
CWE-918 Server-Side request forgery (SSRF)
Vendor / Product
SUSE / Rancher
Sources
cve.org  ·  NVD

Severity & Metrics

5.0 MEDIUM CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
SSVC — CISA Coordinator
Exploitation
none
Automatable
no
Tech. Impact
partial
Affected products (1)
VendorProductPlatformVersions
SUSE Rancher — 0.15.0 < 0.15.2, 0.14.0 < 0.14.6, 0.13.0 < 0.13.11, 0.12.0 < 0.12.15
Weakness (CWE)
CWESourceDescription
CWE-918 cna CWE-918 Server-Side request forgery (SSRF)
CVSS scores (1)
ScoreSeverityVersionSourceVector
5.0 MEDIUM 3.1 cna CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
References (1)
Back to overview