github.com/rancher/fleet vulnerabilities

CVEs whose affected-version data names the github.com/rancher/fleet package (go). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

5 CVEsRSS

CVE-2025-23390Medium· 6.3

1w ago

A vulnerability has been identified within Fleet where, by default, Fleet will automatically trust a remote server’s certificate when connecting through SSH if the certificate isn’t set in the `known_hosts` file

A vulnerability has been identified within Fleet where, by default, Fleet will automatically trust a remote server’s certificate when connecting through SSH if the certificate isn’t set in the `known_hosts` file. This could allow the exe…

▾ SunlitSUSE · github.com/rancher/fleetEPSS 0.19%via NVD

CVE-2026-44938High· 8.8

3mo ago

Fleet has PSS Bypass through addLabelsFromOptions in Fleet Agent

▾ Twilightrancher · github.com/rancher/fleetEPSS 0.44%via GHSA

CVE-2026-44937High· 7.5

3mo ago

Rancher Fleet has Unauthenticated Webhook: Regex Injection via Unsanitized Repository URL Components

▾ Twilightrancher · github.com/rancher/fleetEPSS 0.42%via GHSA

CVE-2026-44936Medium· 5.0

3mo ago

Rancher Fleet has SSRF in Bundle Reader via Unvalidated Helm Repository URL in fleet.yaml

▾ Sunlitrancher · github.com/rancher/fleetEPSS 0.35%via GHSA

CVE-2026-44935Critical· 9.9

3mo ago

Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm Deployer

▾ Midnightrancher · github.com/rancher/fleetEPSS 0.49%via GHSA