External risk intelligence

SUSE Rancher Fleet valuesFrom Reference Validation Allows Tenant Credential Access

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-44935

The vulnerability affects Helm Deployer components within SUSE Rancher Fleet, which are typically used for internal cluster management and tenant orchestration. While these components handle network operations, they are generally deployed within internal infrastructure or management planes rather than being directly exposed to the public internet.

Suse Rancher Fleet

0.12.0 to before 0.12.150.13.0 to before 0.13.110.14.0 to before 0.14.60.15.0 to before 0.15.2

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This CVE affects SUSE Rancher Fleet's Helm Deployer, where a lack of validation allows users in one tenant to potentially view the fleet credentials of other tenants. While the technology is used for managing multiple environments, the main concern is to confirm if your organization uses these specific components and if they are configured in a way that could lead to this exposure.

Tenant credential access risk.
Confirms if specific fleet features are in use.
Validate usage and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker with access to one tenant in SUSE Rancher Fleet could potentially access the fleet credentials of other tenants. This occurs because the Helm Deployer does not properly validate references made in `valuesFrom`. Successful exploitation could allow an attacker to escalate privileges by gaining access to sensitive information from different tenants.

Requires ownership of one tenant.
Unvalidated `valuesFrom` references.
Access to other tenants' credentials.

Live Threat

Current exploitation, exposure, and threat context

The Helm Deployer in SUSE Rancher Fleet has a vulnerability where the "valuesFrom" references are not properly validated. This could allow a tenant with ownership privileges to access fleet credentials belonging to other tenants.

Tenant fleet credentials may be exposed.
Unvalidated references could be exploited.
Unauthorized access to sensitive information.

Operational Fix

Recommended remediation, mitigation, and detection steps

The SUSE Rancher Fleet Helm Deployer's missing validation of "valuesFrom" references introduces a critical risk for multi-tenant environments. Owners of one tenant could potentially access fleet credentials belonging to other tenants. This necessitates immediate investigation to identify affected deployments, assess business criticality and exposure, and confirm the accountable owner for remediation.

Fleet and Platform teams should own this.
Verify cross-tenant access and reachability.
Plan remediation based on tenant risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is SUSE Rancher Fleet?

SUSE Rancher Fleet is a GitOps-based tool designed to manage and deploy applications across large numbers of Kubernetes clusters. It helps teams automate software delivery by continuously syncing configurations from Git repositories to targeted environments. The Helm Deployer component is specifically responsible for processing Helm charts and their associated values, which act as the configuration instructions for these deployments.

What does CWE-1287 mean for CVE-2026-44935?

CWE-1287 refers to improper validation of input. In this context, it means the Helm Deployer fails to verify the source or integrity of 'valuesFrom' references. These references tell the system where to pull specific configuration data from. Because this check is missing, the system blindly trusts requests, allowing a user to point these references toward sensitive information they should not be permitted to access.

How can an attacker trigger this vulnerability?

An attacker must already have ownership privileges within a tenant in the Rancher Fleet environment. By creating or modifying a configuration that includes a crafted 'valuesFrom' reference, they can trick the system into exposing credentials belonging to other tenants. Simply using standard, valid configuration files that do not leverage manipulated 'valuesFrom' references will not trigger this specific vulnerability.

Is my system at risk according to Halo Surface Signal?

Halo Surface Signal indicates that this vulnerability is unlikely to be reachable from the public internet. The affected Helm Deployer components are typically restricted to internal cluster management and private administrative planes. However, if your specific architecture exposes these management tools externally, your risk level would increase significantly compared to a standard internal deployment.

Do I need to update SUSE Rancher Fleet?

Yes. If you operate a multi-tenant environment using Rancher Fleet, you should verify if you are running one of the affected versions (0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11, or 0.12 before 0.12.15). The first step is to identify your deployment version, confirm if you utilize the Helm Deployer, and coordinate with your platform team to apply the available vendor updates.

References

github.com/rancher/fleet/security/advisories/GHSA-xr65-5cpm-g36x

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.