CVE-2026-104615High· 7.9▾ TwilightA security vulnerability was discovered in SUSE Rancher Fleet's cluster registration flow, in Fleet versions before 0.12, 0.13.0 up to 0.13.17, 0.14.0 up to 0.14.12, 0.15.0 up t o 0.15.17 and 0.16.0 up to 0.16.3. The cluster identity cla…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 43.5 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
A security vulnerability was discovered in SUSE Rancher Fleet's cluster registration flow, in Fleet versions before 0.12, 0.13.0 up to 0.13.17, 0.14.0 up to 0.14.12, 0.15.0 up t o 0.15.17 and 0.16.0 up to 0.16.3. The cluster identity claimed by a registration request was accepted without being bound to the registration token that the request was made with. As a result, a registration request could be associated with a managed cluster that was originally registered with a different registration token.
Fleett >= 0.16.0 < 0.16.3Fleett >= 0.15.0. < 0.15.17Fleett >= 0.14.0 < 0.14.12Fleett >= 0.13 < 0.13.17Fleett <= 0.12Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-104623Medium· 6.3Authorization bypass on the local cluster shell endpoint allows an unauthorized Rancher user to obtain a shell pod on the management cluster
CVE-2026-93538High· 7.1A cross-tenant authorization issue was discovered in SUSE Rancher Fleet
CVE-2026-88811Critical· 9.1Rancher credentials disclosed to third-party hosts by the Rancher Manager meta proxy
CVE-2026-94290Critical· 9.1Privilege escalation to cluster-admin on the Rancher local cluster through Fleet's agent management controller
CVE-2026-88810High· 7.2Privilege escalation in downstream clusters via GlobalRole inheritedNamespacedRules
CVE-2026-88809High· 7.6Rancher meta proxy allowlist bypass leading to server-side request forgery