Description
A cross-tenant authorization issue was discovered in SUSE Rancher Fleet. During agent-initiated cluster registration, cluster labels supplied by the registering agent, including labels in the reserved management.cattle.io/ namespace such as the cluster display name label, were applied to the resulting upstream Cluster object. Because Fleet resolves GitRepo and Bundle targets from those cluster labels, a party able to register a cluster into a Fleet workspace namespace shared with other tenants could cause its own cluster to satisfy targeting rules that administrators intended for a different cluster.
This affects SUSE Rancher Fleet 0.16 before 0.16.1, 0.15 before 0.15.6, 0.14 before 0.14.10, 0.13 before 0.13.15, 0.12 before 0.12.19 and older versions.
Published: 2026-09-28
Score: 7.1 High
EPSS: n/a
KEV: No
Impact: Cross-tenant bundle deployment and secret disclosure
Action: Immediate Patch
AI Analysis

Impact

The flaw lets an attacker register a cluster with spoofed labels that are blindly applied to the Cluster object used by Fleet. By manipulating labels in the reserved management.cattle.io namespace, the attacker’s cluster can satisfy targeting rules that were intended for another tenant’s cluster, causing unauthorized bundles—including those containing secrets—to be deployed. This abuse of authority is reflected by the CWE‑290 and CWE‑639 weaknesses.

Affected Systems

SUSE Rancher Fleet versions 0.16 before 0.16.1, 0.15 before 0.15.6, 0.14 before 0.14.10, 0.13 before 0.13.15, 0.12 before 0.12.19 and all older releases.

Risk and Exploitability

The vulnerability carries a CVSS score of 7.1, with no EPSS score available and no listing in CISA KEV. Exploitation requires the ability to register a cluster in a shared workspace; an attacker can then manipulate cluster labels to trigger target resolution intended for other tenants, potentially leading to the deployment of unauthorized bundles and exposure of sensitive information.

Generated by OpenCVE AI on September 28, 2026 at 15:46 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Fleet to a patched release (≥0.16.1, ≥0.15.6, ≥0.14.10, ≥0.13.15, ≥0.12.19 or later).
  • Restrict cluster registration privileges so that only trusted administrators can register clusters within shared workspaces.
  • Validate or remove reserved namespace labels before applying them to the Cluster object to prevent label spoofing.

Generated by OpenCVE AI on September 28, 2026 at 15:46 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 28 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 28 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Description A cross-tenant authorization issue was discovered in SUSE Rancher Fleet. During agent-initiated cluster registration, cluster labels supplied by the registering agent, including labels in the reserved management.cattle.io/ namespace such as the cluster display name label, were applied to the resulting upstream Cluster object. Because Fleet resolves GitRepo and Bundle targets from those cluster labels, a party able to register a cluster into a Fleet workspace namespace shared with other tenants could cause its own cluster to satisfy targeting rules that administrators intended for a different cluster. This affects SUSE Rancher Fleet 0.16 before 0.16.1, 0.15 before 0.15.6, 0.14 before 0.14.10, 0.13 before 0.13.15, 0.12 before 0.12.19 and older versions.
Title Cross-tenant BundleDeployment and Secret disclosure via spoofed cluster labels during agent-initiated registration in Fleet
First Time appeared Suse
Suse rancher
Weaknesses CWE-290
CWE-639
CPEs cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*
Vendors & Products Suse
Suse rancher
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N'}

Subscriptions

Suse Rancher
cve-icon MITRE

Status: PUBLISHED

Assigner: suse

Published:

Updated: 2026-09-28T16:22:26.562Z

Reserved: 2026-09-18T09:08:10.294Z

Link: CVE-2026-93538

cve-icon Vulnrichment

Updated: 2026-09-28T16:22:22.428Z

cve-icon NVD

Status : Received

Published: 2026-09-28T15:17:24.927

Modified: 2026-09-28T17:17:52.663

Link: CVE-2026-93538

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-28T16:00:03Z

Weaknesses
  • CWE-290

    Authentication Bypass by Spoofing

  • CWE-639

    Authorization Bypass Through User-Controlled Key