The flaw stems from the unauthenticated webhook endpoint in SUSE Rancher Fleet consuming repository URL components without proper sanitization. This allows an attacker to inject a malicious regular-expression payload that can forge subsequent webhook requests. A forged request can either bring the target repository down or force it to downgrade, leading to a denial of service or a compromise of repository integrity.

SUSE Rancher Fleet installations running any of the following versions are vulnerable: 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11, and 0.12 before 0.12.5. Administrators should verify whether their deployment falls within these ranges and consider an upgrade.

The CVSS v3.1 score of 8.3 indicates high severity, while an EPSS score below 1% suggests that exploitation is currently unlikely. Based on the description, it is inferred that the unauthenticated webhook endpoint allows any host that can reach the Fleet API to potentially carry out the attack, raising the risk for exposed or publicly reachable deployments. The vulnerability is not listed in CISA’s KEV catalog. Attackers would need only network access to the Fleet service and would provide crafted webhook requests that trigger the injected regex, potentially causing a denial of service or repository downgrade.