SUSE Rancher Fleet: Privilege Escalation via Unauthorized Kubeconfig Reference (CVE-2026-94290)

SUSE Rancher Fleet clusters reference kubeconfig secrets for the deployment and management of agents on target clusters. A vulnerability exists where the controller does not properly validate or restrict which kubeconfig secrets a Fleet Cluster object may reference. An attacker with control over a namespace can configure a Fleet Cluster object to reference administrative kubeconfig secrets belonging to the management cluster. This results in the Fleet controller interacting with the management cluster using these administrative credentials, enabling the attacker to execute arbitrary Fleet content within the management cluster with elevated privileges.

Impact

Successful exploitation allows for privilege escalation from a namespace-restricted user to administrative control over the management cluster, potentially leading to full cluster compromise.

Recommendation

• Upgrade Rancher Fleet to a patched version once available from SUSE.
• Audit existing Fleet Cluster objects for suspicious kubeconfig secret references, particularly those pointing to secrets outside of the object's namespace.
• Restrict RBAC permissions for creating or modifying Fleet Cluster objects in non-administrative namespaces.