Rancher

This brief details how attackers may leverage the `systemd-run` utility on Linux systems for defense evasion and execution by running commands as detached, transient services or scopes to obscure their activities and parent-child process chains.

A vulnerability in Fleet's agent-side deployer (CVE-2026-44938) allows an attacker with `git push` access to a Fleet-monitored repository to overwrite Pod Security Standards (PSS) enforcement labels on target Kubernetes namespaces, bypassing admission controls and enabling the deployment of otherwise prohibited workloads.

An unauthenticated regex injection vulnerability exists in Rancher Fleet's webhook endpoint when it's configured without a secret, allowing attackers to forge webhook requests using unsanitized repository URL components, which leads to continuous repository re-cloning, causing network and resource exhaustion (Denial of Service) on the management cluster, and potentially service downgrades if the attacker has read access to the target Git repository.

A critical privilege escalation vulnerability exists in Rancher Manager where a Project Owner can modify Pod Security Admission (PSA) labels on namespaces within their projects, allowing them to configure a namespace to use the privileged profile, which enables the deployment of privileged workloads that bypass standard container isolation, leading to host-level access and cluster privilege escalation.

This rule detects Linux process executions that access high-value Kubernetes service-account material, kubeconfig or node PKI paths, or common cloud files, potentially indicating credential theft within in-cluster and hybrid environments.

A malicious user with permission to edit the `local-path-config` ConfigMap in the `local-path-storage` namespace can manipulate the `helperPod.yaml` template used by `rancher/local-path-provisioner`. Security-sensitive fields such as `securityContext.privileged`, `hostPath` volumes, and Linux capabilities can be injected into the template, leading to a privileged pod running on the target node with the host root filesystem mounted.

A remote, authenticated attacker can exploit a vulnerability in Rancher Fleet Helm Deployer to bypass security measures and disclose sensitive information, which may enable further attacks.

Fleet's Helm deployer did not fully apply ServiceAccount impersonation in two code paths, allowing a tenant with git push access to a Fleet-monitored repository to read secrets from any namespace on every downstream cluster targeted by their `GitRepo`.

An authenticated, remote attacker can exploit a vulnerability in Rancher to execute arbitrary program code and manipulate files, potentially leading to privilege escalation and system compromise.