CVE-2026-93538
EUVD-2026-8829428.09.2026, 15:17
A cross-tenant authorization issue was discovered in SUSE Rancher Fleet. During agent-initiated cluster registration, cluster labels supplied by the registering agent, including labels in the reserved management.cattle.io/ namespace such as the cluster display name label, were applied to the resulting upstream Cluster object. Because Fleet resolves GitRepo and Bundle targets from those cluster labels, a party able to register a cluster into a Fleet workspace namespace shared with other tenants could cause its own cluster to satisfy targeting rules that administrators intended for a different cluster. This affects SUSE Rancher Fleet 0.16 before 0.16.1, 0.15 before 0.15.6, 0.14 before 0.14.10, 0.13 before 0.13.15, 0.12 before 0.12.19 and older versions.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| suse | rancher_fleet | 0.12.0 ≤ 𝑥 < 0.12.19 |
| suse | rancher_fleet | 0.13.0 ≤ 𝑥 < 0.13.15 |
| suse | rancher_fleet | 0.14.0 ≤ 𝑥 < 0.14.10 |
| suse | rancher_fleet | 0.15.0 ≤ 𝑥 < 0.15.6 |
| suse | rancher_fleet | 0.16.0 ≤ 𝑥 < 0.16.1 |
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources
(CNA/ADP records, vendor advisories, Enginsight analysis).
| Vendor | Product | Version | Source |
|---|---|---|---|
| suse | rancher | 0.16.0 ≤ 𝑥 < 0.16.1 | CNA |
| suse | rancher | 0.15.0 ≤ 𝑥 < 0.15.6 | CNA |
| suse | rancher | 0.14.0 ≤ 𝑥 < 0.14.10 | CNA |
| suse | rancher | 0.13.0 ≤ 𝑥 < 0.13.15 | CNA |
| suse | rancher | 0.12.0 ≤ 𝑥 < 0.12.19 | CNA |
Common Weakness Enumeration