CVE-2026-94290

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-94290

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-94290.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-94290

Aliases

GHSA-qfmw-gw96-ffcr

Published

2026-11-02T15:29:41Z

Modified

2026-11-03T02:47:28Z

Severity

9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H CVSS Calculator

Summary

Privilege escalation to cluster-admin on the Rancher local cluster through Fleet's agent management controller

Details

SUSE Rancher Fleet clusters reference a kubeconfig secret that the controller uses to install and manage a Fleet agent on the target cluster. The controller did not sufficiently restrict which kubeconfig secrets a Fleet Cluster object was allowed to reference. As a result, a Fleet cluster defined in a namespace an ordinary user controls could be associated with administrative credentials for the management cluster itself, causing the controller to manage the management cluster on that user's behalf and to run that user's Fleet content there with elevated privileges. This affects SUSE Rancher Fleet 0.16.0 up to 0.16.3, 0.15.0 up to 0.15.8, 0.14.0 up to 0.14.12, 0.13.0 up to 0.13.17 and possible older versions.

Database specific

{
    "cna_assigner": "suse",
    "cwe_ids": [
        "CWE-250"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/94xxx/CVE-2026-94290.json"
}

References

Affected packages

Git / github.com/rancher/fleet

Affected ranges

Type

GIT

Repo

https://github.com/rancher/fleet

Events

Introduced

c1a4325041578226f4f333b9f05d651ee4b03577

Fixed

2137e669ebec4d397262df1149edb65bceaa4466

Introduced

c63dc4bb52acb88fea50fe1b5f20db7f3ca6c9d9

Fixed

e12b1bdb710c541f958b6e2d31d0a6957a23b81c

Introduced

53de8d76a46c737f4b055dd1a7f2b7ac682537c5

Fixed

ba0b25380d60b9b62b8ffd0c75ea833bafcfefea

Introduced

e0324f2d4c06dad05a298622a1276ea596367b6a

Fixed

ad4df198a7aa2682d0d9ec07d7eff5379cd1d8e2

Database specific

Show details

{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0.16.0"
                },
                {
                    "fixed": "0.16.3"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "introduced": "0.15.0"
                },
                {
                    "fixed": "0.15.8"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "introduced": "0.14.0"
                },
                {
                    "fixed": "0.14.12"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "introduced": "0.13.0"
                },
                {
                    "fixed": "0.13.17"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        }
    ]
}

Affected versions

pkg/apis/v0.*

pkg/apis/v0.13.0

pkg/apis/v0.13.11

pkg/apis/v0.13.11-rc.1

pkg/apis/v0.13.11-rc.2

pkg/apis/v0.13.13

pkg/apis/v0.13.14

pkg/apis/v0.13.16

pkg/apis/v0.13.17-alpha.1

pkg/apis/v0.13.17-beta.1

pkg/apis/v0.13.17-rc.1

pkg/apis/v0.13.7

pkg/apis/v0.13.7-rc.1

pkg/apis/v0.13.7-rc.2

pkg/apis/v0.14.0

pkg/apis/v0.14.11

pkg/apis/v0.14.12-alpha.1

pkg/apis/v0.14.12-beta.1

pkg/apis/v0.14.12-rc.1

pkg/apis/v0.14.2

pkg/apis/v0.14.2-beta.1

pkg/apis/v0.14.2-rc.1

pkg/apis/v0.14.2-rc.2

pkg/apis/v0.14.6

pkg/apis/v0.14.6-rc.2

pkg/apis/v0.14.6-rc.3

pkg/apis/v0.14.8

pkg/apis/v0.14.9

pkg/apis/v0.15.0

pkg/apis/v0.15.2

pkg/apis/v0.15.2-rc.2

pkg/apis/v0.15.2-rc.3

pkg/apis/v0.15.4

pkg/apis/v0.15.5

pkg/apis/v0.15.7

pkg/apis/v0.15.8-alpha.1

pkg/apis/v0.15.8-alpha.2

pkg/apis/v0.15.8-beta.1

pkg/apis/v0.15.8-rc.1

pkg/apis/v0.15.8-rc.2

pkg/apis/v0.16.0

pkg/apis/v0.16.1

pkg/apis/v0.16.1-beta.1

pkg/apis/v0.16.1-rc.1

pkg/apis/v0.16.2

pkg/apis/v0.16.3-alpha.1

pkg/apis/v0.16.3-alpha.2

pkg/apis/v0.16.3-beta.1

pkg/apis/v0.16.3-beta.2

pkg/apis/v0.16.3-rc.1

pkg/helmvalues/v0.*

pkg/helmvalues/v0.16.1

pkg/helmvalues/v0.16.1-rc.1

pkg/helmvalues/v0.16.2

pkg/helmvalues/v0.16.3-alpha.1

pkg/helmvalues/v0.16.3-alpha.2

pkg/helmvalues/v0.16.3-beta.1

pkg/helmvalues/v0.16.3-beta.2

pkg/helmvalues/v0.16.3-rc.1

v0.*

v0.13.0

v0.13.0-rc.4

v0.13.1

v0.13.1-beta.1

v0.13.1-beta.2

v0.13.1-rc.1

v0.13.1-rc.2

v0.13.1-rc.3

v0.13.1-rc.4

v0.13.1-rc.5

v0.13.1-rc.6

v0.13.10

v0.13.10-beta.1

v0.13.10-beta.2

v0.13.10-beta.3

v0.13.10-beta.4

v0.13.10-beta.5

v0.13.10-rc.1

v0.13.10-rc.2

v0.13.11

v0.13.11-rc.1

v0.13.11-rc.2

v0.13.12

v0.13.12-rc.1

v0.13.13

v0.13.14

v0.13.14-rc.1

v0.13.14-rc.2

v0.13.15

v0.13.15-rc.1

v0.13.15-rc.2

v0.13.16

v0.13.16-rc.1

v0.13.16-rc.2

v0.13.17-alpha.1

v0.13.17-beta.1

v0.13.17-rc.1

v0.13.2

v0.13.2-rc.1

v0.13.2-rc.2

v0.13.3

v0.13.4

v0.13.4-rc.1

v0.13.4-rc.2

v0.13.5

v0.13.5-beta.1

v0.13.5-rc.1

v0.13.5-rc.2

v0.13.5-rc.3

v0.13.6

v0.13.6-beta.1

v0.13.6-rc.1

v0.13.7

v0.13.7-alpha.1

v0.13.7-alpha.2

v0.13.7-rc.1

v0.13.7-rc.2

v0.13.8

v0.13.8-rc.1

v0.13.9

v0.13.9-rc.1

v0.13.9-rc.3

v0.13.9-rc.4

v0.14.0

v0.14.1

v0.14.1-beta.1

v0.14.1-beta.2

v0.14.1-beta.3

v0.14.1-beta.4

v0.14.1-rc.1

v0.14.10

v0.14.10-rc.1

v0.14.10-rc.2

v0.14.11

v0.14.11-rc.1

v0.14.11-rc.2

v0.14.12-alpha.1

v0.14.12-beta.1

v0.14.12-rc.1

v0.14.2

v0.14.2-beta.1

v0.14.2-rc.1

v0.14.2-rc.2

v0.14.3

v0.14.3-beta.1

v0.14.3-rc.1

v0.14.3-rc.2

v0.14.3-rc.3

v0.14.4

v0.14.4-beta.1

v0.14.4-beta.2

v0.14.4-rc.1

v0.14.4-rc.2

v0.14.4-rc.3

v0.14.4-rc.4

v0.14.4-rc.5

v0.14.5

v0.14.5-beta.1

v0.14.5-beta.2

v0.14.5-beta.3

v0.14.5-beta.4

v0.14.5-beta.5

v0.14.5-rc.1

v0.14.5-rc.2

v0.14.6

v0.14.6-rc.1

v0.14.6-rc.2

v0.14.6-rc.3

v0.14.7

v0.14.7-rc.1

v0.14.7-rc.2

v0.14.8

v0.14.9

v0.14.9-rc.1

v0.14.9-rc.2

v0.15.0

v0.15.0-rc.6

v0.15.1

v0.15.1-beta.1

v0.15.1-beta.2

v0.15.1-beta.3

v0.15.1-beta.4

v0.15.1-rc.1

v0.15.1-rc.2

v0.15.2

v0.15.2-rc.1

v0.15.2-rc.2

v0.15.2-rc.3

v0.15.3

v0.15.3-beta.1

v0.15.3-beta.2

v0.15.3-rc.1

v0.15.3-rc.2

v0.15.4

v0.15.5

v0.15.5-rc.1

v0.15.5-rc.2

v0.15.6

v0.15.6-alpha.1

v0.15.6-rc.1

v0.15.7

v0.15.7-rc.1

v0.15.7-rc.2

v0.15.8-alpha.1

v0.15.8-alpha.2

v0.15.8-beta.1

v0.15.8-rc.1

v0.15.8-rc.2

v0.16.0

v0.16.0-rc.5

v0.16.1

v0.16.1-beta.1

v0.16.1-beta.2

v0.16.1-rc.1

v0.16.1-rc.2

v0.16.2

v0.16.2-rc.1

v0.16.2-rc.2

v0.16.3-alpha.1

v0.16.3-alpha.2

v0.16.3-beta.1

v0.16.3-beta.2

v0.16.3-rc.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-94290.json"