CVE-2026-41050 Security Alert: CRITICAL Vulnerability

Urgent: CVE-2026-41050 requires immediate attention.

· 3 min read

```html

Executive Summary

A critical vulnerability identified as CVE-2026-41050 affects the github.com/rancher/fleet Helm deployer, allowing unauthorized access to secrets across Kubernetes namespaces. This vulnerability has a CVSS score of 9.9, indicating a high risk for multi-tenant deployments. Immediate action is required to mitigate the risk of credential leakage.

Immediate Action

  • Upgrade to patched versions of Rancher: v2.14.1, v2.13.5, v2.12.9, v2.11.13. For v2.10.11, manually update Fleet to v0.11.13.
  • Restrict git push access to trusted users only, especially in multi-tenant setups.
  • Audit your fleet.yaml files and Helm chart templates for any cross-namespace references.
  • Consult the vendor advisory for more details on the vulnerability.
  • Regularly monitor for updates from the SUSE Rancher Security team.

Affected Versions

  • github.com/rancher/fleet@<=v0.11.12 vulnerable; upgrade to v0.11.13+
  • Rancher v2.10.11 vulnerable; upgrade to v2.11.13+
  • Rancher v2.11.x vulnerable; upgrade to v2.12.9+
  • Rancher v2.12.x vulnerable; upgrade to v2.13.5+
  • Rancher v2.13.x vulnerable; upgrade to v2.14.1+

Resolution Guide

To apply the necessary updates, use the following commands:

# For Rancher
# Upgrade Rancher to the latest patched version
curl -sSL https://get.rancher.io | sh

# For Fleet
# If using v2.10.11, manually update Fleet
kubectl apply -f https://github.com/rancher/fleet/releases/download/v0.11.13/fleet.yaml

Ensure to audit your fleet.yaml for any references that may expose secrets:

# Example check for cross-namespace valuesFrom references
grep -r 'valuesFrom' ./path/to/your/fleet/configs/

Detection & Verification

To check if you are vulnerable, run the following command to verify your Fleet version:

kubectl get deployment fleet -n kube-system -o=jsonpath='{.spec.template.spec.containers[:1].image}'

To verify that the patch has been applied, ensure your version reflects the latest updates:

kubectl get deployment fleet -n kube-system -o=jsonpath='{.spec.template.spec.containers[:1].image}' | grep 'v0.11.13'

Risk and Impact

The exploit allows a tenant with git push access to read secrets from any namespace across all clusters monitored by Fleet. This breaks the expected multi-tenant security model, potentially exposing sensitive credentials and increasing the risk of unauthorized access to external services.

```

Keep reading