CVE-2026-44935— Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm Deployer
Possible ATT&CK Techniques 1AI
T1078 · Valid AccountsGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-44935
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm Deployer
Source: NVD (National Vulnerability Database)
Vulnerability Description
Missing validation of "valuesFrom" references in Helm Deployer of SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.15 could be used by owners of one tenant to access fleet credentials of other tenants.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
CWE-1287
Source: NVD (National Vulnerability Database)
Vulnerability Title
SUSE rancher 软件供应链问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
SUSE rancher是德国SUSE公司开源的一套容器管理平台。 SUSE rancher存在软件供应链问题漏洞，该漏洞源于Helm Deployer中“valuesFrom”引用验证缺失，可能导致一个租户的所有者访问其他租户的fleet凭据。以下版本受到影响：0.15.2版本之前的0.15.x版本、0.14.6版本之前的0.14.x版本、0.13.11版本之前的0.13.x版本和0.12.15版本之前的0.12.x版本。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-44935
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
Qwen3.6-35B-A3B · 8833 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month
III. Intelligence Information for CVE-2026-44935
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-44935 (1)
IV. Related Vulnerabilities
Same product: Rancher
- CVE-2026-44948
Path Traversal in Rancher Fleet ImageScan GitRepo Path Handl - CVE-2026-44949
Unauthenticated namespace creation and RBAC injection via ra - CVE-2026-44947
Stale PSA ClusterRoleBinding Persists After RoleTemplate Dow - CVE-2026-44946
SAML Authentication Replay in Rancher - CVE-2026-41053
Over-inclusive team membership expansion in GitHub App authe
Same vendor: SUSE
- CVE-2026-44941
libzypp path traversal via "keyhint" in repomd.xml - CVE-2026-44948
Path Traversal in Rancher Fleet ImageScan GitRepo Path Handl - CVE-2026-44949
Unauthenticated namespace creation and RBAC injection via ra - CVE-2026-44947
Stale PSA ClusterRoleBinding Persists After RoleTemplate Dow - CVE-2026-44946
SAML Authentication Replay in Rancher
Same weakness: CWE-1287
- CVE-2026-54235
vLLM: temperature=NaN and temperature=Infinity bypass valida - CVE-2026-10825
Improper JSON Input Validation in WebSocket API Leads to Den - CVE-2026-9753
Server crash via malformed binary diff passed to $_internalA - CVE-2026-9742
Authenticate command with specific mechanism parameter can t - CVE-2026-11460
Boost Serialization improper validation of specified type of
V. Comments for CVE-2026-44935
No comments yet