CVE-2026-41050: Fleet Helm deployer impersonation flaw allows cross-namespace secret read
CVE-2026-41050 is a critical incorrect-authorization flaw (CWE-863) in Fleet's Helm deployer, which did not fully apply ServiceAccount impersonation in two code paths. According to the record, a tenant with git push access to a Fleet-monitored repository could read secrets from any namespace on each downstream cluster targeted by their GitRepo. SUSE, as CNA, scored it 9.9 under CVSS 3.1, the CVE is not listed in KEV, and the record lists no fixed versions.
Overview
CVE-2026-41050 concerns Fleet's Helm deployer, which did not fully apply ServiceAccount impersonation in two code paths. The record classifies the weakness as CWE-863 (Incorrect Authorization), was published on 2026-05-13, and has the status Undergoing Analysis.
Impact
- According to the description, a tenant with git push access to a Fleet-monitored repository could read secrets from any namespace on every downstream cluster targeted by their GitRepo.
- SUSE assigned a CVSS 3.1 base score of 9.9 (critical) with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, which describes high confidentiality, integrity and availability impact.
- The SSVC technical impact is recorded as total.
Affected products and versions
The record lists the product as Suse Rancher with these ranges:
- ≥ 0.15.0 and < 0.15.1
- ≥ 0.14.0 and < 0.14.5
- ≥ 0.13.0 and < 0.13.10
- ≥ 0.12.0 and < 0.12.14
- ≥ 0.11.0 and < 0.11.13
The record does not list fixed versions. The upper bounds of the ranges may indicate the first releases outside each range, but this is an inference and not a confirmed fix.
Exploitation status
The record shows KEV listed as false, so no active exploitation is confirmed. No confirmed exploitation appears in the sources consulted. The recorded SSVC values are exploitation none and automatable no.
Remediation and mitigation
- Check whether your environment runs Fleet with Helm-based deployments within the listed ranges.
- Follow the vendor tracking entries for fixed releases: SUSE Bugzilla entry and GitHub advisory GHSA-765j-qfrp-hm3j.
- Until a fix is applied, limit which users can push to repositories monitored by Fleet and review repository write permissions.
- Review which secrets are reachable from downstream clusters targeted by GitRepo resources, and reduce cross-namespace secret exposure where it is not needed.
Detection guidance
- Audit Git push activity to Fleet-monitored repositories, especially from tenants with limited trust.
- Review Fleet GitRepo resources and their target clusters for unexpected changes.
- Where logging permits, monitor for unusual secret access across namespaces on downstream clusters.
Limitations of the available information
- The record does not specify which code paths were affected, which fixed versions exist, or whether patches have been published.
- The status is Undergoing Analysis, so details may change.
- The EPSS date in the record (2026-10-13) is later than the publication date; it is reported as recorded.
- The record names the product as Suse Rancher, while the description refers to Fleet's Helm deployer. The record does not explain the relationship between the two.
Frequently asked questions
Is CVE-2026-41050 being actively exploited?
The record shows the CVE is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted. The recorded SSVC exploitation value is none.
Which versions are affected?
The record lists Suse Rancher ranges from 0.11.0 up to but not including 0.11.13, 0.12.0 to 0.12.14, 0.13.0 to 0.13.10, 0.14.0 to 0.14.5, and 0.15.0 to 0.15.1. It does not list fixed versions, so check the vendor tracking entries.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.