CVE-2026-93539
Received Received - Intake

GitWebhook Secret Bypass in SUSE Rancher Fleet

Publication date: 2026-09-28

Last updated on: 2026-09-28

Assigner: SUSE

Description
A vulnerability was discovered in Fleet's Git webhook receiver (the gitjob webhook service). When a webhook secret is not configured, incoming webhook requests are accepted without verification, and processing a request can change the spec.pollingInterval field of a matching GitRepo resource in any namespace. A caller with network access to the webhook service and no Kubernetes credentials can therefore alter GitRepo configuration outside the namespaces they are authorized for.  This only affects SUSE Rancher Fleet 0.16 before 0.16.2, older versions are not affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-28
Last Modified
2026-09-28
Generated
2026-09-28
AI Q&A
2026-09-28
EPSS Evaluated
N/A
NVD
CVE-2026-93539
EUVD
EUVD-2026-88296

Affected Vendors & Products

Showing 7 associated CPEs
Vendor Product Version / Range
suse rancher_fleet to 0.16.2 (exc)
suse rancher_fleet 0.16.0
suse rancher_fleet 0.16.1
suse rancher_fleet From 0.16.2 (exc)
suse rancher 2.15.0
suse rancher 2.15.1
suse rancher From 2.15.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Fleet's Git webhook receiver in SUSE Rancher Fleet versions 0.16.0 and 0.16.1. When no webhook secret is configured, attackers with network access can modify the polling interval of GitRepo resources in any namespace without authentication. This allows them to set the interval to one hour, causing delays in Git changes and additional Git operations.

Detection Guidance

Check if Fleet's Git webhook receiver is running without a configured webhook secret. Inspect GitRepo resources for unexpected changes to the spec.pollingInterval field. Verify network access restrictions to the webhook service.

Impact Analysis

An attacker could disrupt Git operations by delaying legitimate changes and increasing Git operations. Deployed content remains unaffected, and no data is disclosed. The impact is limited to availability and integrity of GitRepo configurations.

Compliance Impact

This vulnerability does not directly disclose data or affect deployed content, so it likely has minimal direct impact on compliance with standards like GDPR or HIPAA. However, unauthorized modification of GitRepo configurations could indirectly affect integrity and availability of systems, which may require review under compliance frameworks that mandate secure configuration management and audit controls.

Mitigation Strategies

Upgrade Fleet to version 0.16.2 or later. Configure a webhook secret for the Git webhook receiver. Set an explicit polling interval for GitRepo resources. Restrict network access to the webhook service to authorized sources only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-93539. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart