CVE-2026-44937

EUVD-2026-41867
Potential forgery of webhook requests when using a unauthenticated webhook in SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.5 could be used by remote attackers to cause a denial of service or a downgrade attack on other repositories on the system.
SSRF
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
suseCNA
8.3 HIGH
NETWORK
HIGH
NONE
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 7%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
suserancher
0.15.0 ≤
𝑥
< 0.15.2
CNA
suserancher
0.14.0 ≤
𝑥
< 0.14.6
CNA
suserancher
0.13.0 ≤
𝑥
< 0.13.11
CNA
suserancher
0.12.0 ≤
𝑥
< 0.12.15
CNA
Common Weakness Enumeration
Vulnerability Media Exposure
References
https://github.com/rancher/fleet/security/advisories/GHSA-jmf4-m7j9-g72r