External risk intelligence

SUSE Rancher Fleet Cluster Secret Access Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-94290

The vulnerability involves internal management operations within SUSE Rancher Fleet, specifically concerning how the controller manages kubeconfig secrets for cluster agents. While reachable via network, these management cluster configurations and cluster-to-controller interactions are typically restricted to internal administrative environments and are not intended to be exposed directly to the public internet.

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in SUSE Rancher Fleet could allow an unauthorized user to gain administrative control over the management cluster. This occurs when the controller improperly references secrets, enabling a user to leverage administrative credentials for the management cluster to deploy their own content with elevated privileges.

User access could lead to unauthorized management.
Protects against unauthorized administrative control.
Confirm relevance and exposure of internal management systems.

Attack Path

How an attacker could exploit the issue

An attacker with ordinary user privileges could manipulate a Fleet cluster object to reference administrative credentials for the management cluster. This allows the attacker's Fleet content to be executed on the management cluster with elevated privileges, effectively giving them control over it.

Requires ordinary user access.
Fleet cluster references administrative credentials.
Attacker gains elevated management control.

Live Threat

Current exploitation, exposure, and threat context

When SUSE Rancher Fleet is configured, a controller may associate administrative credentials for the management cluster with a Fleet cluster in a user-controlled namespace. This could allow an ordinary user to manage the management cluster on the controller's behalf and execute their Fleet content with elevated privileges on the management cluster.

Management cluster credentials.
Controller misconfiguration allows association.
User can execute code with elevated privileges.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts SUSE Rancher Fleet and could allow unauthorized users to gain elevated privileges on the management cluster. The platform or infrastructure team, in coordination with the security team, should take the lead in addressing this. The initial step is to identify all instances of SUSE Rancher Fleet, confirm their exposure and criticality, and then work with application owners to plan and execute remediation.

Platform/Infrastructure or Security team ownership.
Verify affected Fleet installations and exposure.
Plan and execute vendor-coordinated remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is SUSE Rancher Fleet and why is it used?

SUSE Rancher Fleet is a Kubernetes-native tool designed for managing deployments across many clusters at scale. It uses a centralized controller to distribute configurations and applications from a management cluster down to downstream clusters, automating the orchestration and lifecycle management of these environments.

What vulnerability class does CVE-2026-94290 involve?

This issue is categorized as CWE-250: Execution with Unnecessary Privileges. In this case, the Fleet controller fails to properly restrict which secrets it can access. An ordinary user can trick the system into using administrative credentials meant for the management cluster, causing the controller to perform actions with higher authority than the user should possess.

How can an attacker trigger this vulnerability?

An attacker needs the ability to create or edit a Fleet cluster object within a namespace they control. By referencing a kubeconfig secret intended for administrative use, they can force the controller to deploy content using those privileged credentials. Simply having read-only access or being unable to create Fleet cluster resources prevents this specific trigger path.

Is this CVE relevant to my systems?

Halo Surface Signal notes that this vulnerability involves internal management operations between controllers and clusters. Because these interactions are typically confined to administrative environments rather than public-facing services, the risk is lower for systems that are not exposed to the internet, though it remains a concern for internal multi-tenant clusters.

What steps should I take if I use SUSE Rancher Fleet?

Your platform or infrastructure team should first audit existing Fleet cluster configurations to ensure they are not referencing unauthorized or administrative credentials. Coordinate with your security team to verify which versions you are running and follow the vendor's guidance to apply necessary updates or configuration changes to isolate cluster secrets.

References

github.com/rancher/fleet/security/advisories/GHSA-qfmw-gw96-ffcr

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.