Vulnerability in SUSE Rancher

[ Description ]Official description

A privilege mismatch was found in Fleet. When a bundle requested namespace labels or annotations through the namespaceLabels and namespaceAnnotations options, the resulting namespace metadata update was not subject to the same authorization as the rest of the bundle's deployment. As a result, a bundle could change labels and annotations on a target namespace even when the identity it was pinned to was not authorized to modify that namespace. This affected SUSE Rancher Fleet 0.16 before 0.16.2, 0.15 before 0.15.7, 0.14 before 0.14.11, 0.13 before 0.13.16 and potentially older versions.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund23 Sep 2026WID-SEC-2026-3546

  Fleet: Multiple vulnerabilities Translated from German

  CVE-2026-93537CVE-2026-93539CVE-2026-93538+2 more CVEs

[ References ]References

• github.com/rancher/fleet/security/advisories/GHSA-m93g-8438-2cggVendor Advisory