Cpe:2.3:a:suse:rancher_fleet:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3asuserancher_fleet/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 02 Nov 2026 17:53:51 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgSUSE Rancher Fleet: Privilege Escalation via Unauthorized Kubeconfig Reference (CVE-2026-94290)https://feed.craftedsignal.io/briefs/2026-11-suse-rancher-fleet-privesc/Mon, 02 Nov 2026 17:53:51 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-suse-rancher-fleet-privesc/SUSE Rancher Fleet fails to restrict kubeconfig secret references, allowing a user to associate cluster definitions with management-level administrative credentials and execute arbitrary content with elevated privileges.SUSE Rancher Fleet clusters reference kubeconfig secrets for the deployment and management of agents on target clusters. A vulnerability exists where the controller does not properly validate or restrict which kubeconfig secrets a Fleet Cluster object may reference. An attacker with control over a namespace can configure a Fleet Cluster object to reference administrative kubeconfig secrets belonging to the management cluster. This results in the Fleet controller interacting with the management cluster using these administrative credentials, enabling the attacker to execute arbitrary Fleet content within the management cluster with elevated privileges.

Impact

Successful exploitation allows for privilege escalation from a namespace-restricted user to administrative control over the management cluster, potentially leading to full cluster compromise.

Recommendation

  • Upgrade Rancher Fleet to a patched version once available from SUSE.
  • Audit existing Fleet Cluster objects for suspicious kubeconfig secret references, particularly those pointing to secrets outside of the object's namespace.
  • Restrict RBAC permissions for creating or modifying Fleet Cluster objects in non-administrative namespaces.
]]>criticaladvisoryprivilege-escalationkubernetescloud