CVE-2026-94290
Received Received - Intake

Privilege Escalation in SUSE Rancher Fleet

Publication date: 2026-11-02

Last updated on: 2026-11-02

Assigner: SUSE

Description
SUSE Rancher Fleet clusters reference a kubeconfig secret that the controller uses to install and manage a Fleet agent on the target cluster. The controller did not sufficiently restrict which kubeconfig secrets a Fleet Cluster object was allowed to reference. As a result, a Fleet cluster defined in a namespace an ordinary user controls could be associated with administrative credentials for the management cluster itself, causing the controller to manage the management cluster on that user's behalf and to run that user's Fleet content there with elevated privileges. This affects SUSE Rancher Fleet 0.16.0 up to 0.16.3, 0.15.0 up to 0.15.8, 0.14.0 up to 0.14.12, 0.13.0 up to 0.13.17 and possible older versions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-02
Last Modified
2026-11-02
Generated
2026-11-02
AI Q&A
2026-11-02
EPSS Evaluated
N/A
NVD
CVE-2026-94290

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
SUSE Rancher 0.16.0
SUSE Rancher 0.15.0
SUSE Rancher 0.14.0
SUSE Rancher 0.13.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-250 The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves SUSE Rancher Fleet clusters referencing a kubeconfig secret that the controller uses to manage Fleet agents. The controller did not properly restrict which kubeconfig secrets a Fleet Cluster object could reference, allowing an ordinary user in a controlled namespace to associate administrative credentials for the management cluster. This could lead the controller to manage the management cluster on the user's behalf with elevated privileges.

Detection Guidance

To detect this vulnerability, check for unauthorized Fleet agent installations or unexpected kubeconfig secret references in your Rancher management cluster. Review Fleet Cluster objects in user namespaces for references to administrative kubeconfig secrets. Use commands like kubectl get fleetclusters --all-namespaces to list all Fleet clusters and kubectl get secrets --all-namespaces to inspect secret references. Look for secrets with labels or names indicating management cluster access.

Impact Analysis

An attacker with access to a namespace could escalate privileges by causing the Fleet controller to use administrative credentials for the management cluster. This could allow the attacker to run their own Fleet content on the management cluster with high privileges, potentially compromising the entire cluster and its resources.

Compliance Impact

This vulnerability could lead to unauthorized access and control of the management cluster, violating data integrity and confidentiality requirements in standards like GDPR and HIPAA. It may result in unauthorized data access, processing, or disclosure, leading to compliance breaches and potential legal consequences.

Mitigation Strategies

Upgrade SUSE Rancher Fleet to a patched version (0.16.4 or later, 0.15.9 or later, 0.14.13 or later, 0.13.18 or later) to address the kubeconfig secret restriction issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-94290. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...