CVE-2026-93537Path traversal in Fleet Helm valuesFiles allows disclosure of files outside the bundle directory
Updated under an hour ago ()
Does this affect you?
It affects SUSE Rancher and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
A user who can supply bundle content to a repository referenced by a GitRepo resource, for example through Git push access, or through permission to create or modify a GitRepo, can cause SUSE Rancher Fleet to read files from the filesystem of the environment that processes the bundle and include their contents in the generated Bundle resource. This can expose configuration or credential material that the user has no Kubernetes RBAC permission to read, including Helm registry credentials made available to the bundle-processing job when per-path Helm credentials are configured. This affects Fleet 0.16 before 0.16.2, 0.15 before 0.15.7, 0.14 before 0.14.11, 0.13 before 0.13.16, 0.12 before 0.12.20 and potentially older unsupported versions.
- CVSS
- 6.5 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Weakness (CWE)
- CWE-23
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- suse
- NVD analysis
- Analyzed
- Record last updated
- Sep 28, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
SUSE Rancher suse:rancher (from the name) | from 0.16.0 before 0.16.2; from 0.15.0 before 0.15.7; from 0.14.0 before 0.14.11; from 0.13.0 before 0.13.16; from 0.12.0 before 0.12.20 | CNA record |
suse rancher_fleet suse:rancher_fleet | from 0.12.0 before 0.12.20; from 0.13.0 before 0.13.16; from 0.14.0 before 0.14.11; from 0.15.0 before 0.15.7; from 0.16.0 before 0.16.2 | NVD |
References
- https://github.com/rancher/fleet/security/advisories/GHSA-wpfm-r97v-3j4hvendor-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.