{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "Rancher and Fleet October 2026 security release: any Rancher user could become cluster-admin on the management cluster (CVE-2026-94290) · updates",
  "home_page_url": "https://pwn.watch/i/rancher-fleet-oct-2026-security-release-cluster-admin-escalation",
  "feed_url": "https://pwn.watch/i/rancher-fleet-oct-2026-security-release-cluster-admin-escalation/feed.json",
  "description": "SUSE shipped Rancher Manager v2.15.3, v2.14.7, v2.13.11, v2.12.15 and v2.11.19 with Fleet v0.16.3, v0.15.8, v0.14.12 and v0.13.17 on Oct 29 2026, fixing six vulnerabilities. The worst is CVE-2026-94290 (CVSS 4.0 9.4 critical) in Fleet's agent management controller, which runs on the Rancher local cluster as cluster-admin: it did not restrict which kubeconfig secrets a Fleet Cluster object could reference, so an authenticated Rancher user with only the default user global role could get full cluster-admin on the management cluster, exposing every secret there, including credentials for all downstream clusters. Fleet is enabled by default in Rancher. The release also fixes CVE-2026-104615 (high), a Fleet cluster identity takeover where a holder of a workspace registration token could claim another cluster's identity and read Secrets and ConfigMaps synced into its Fleet namespace; CVE-2026-104623 (medium), where any authenticated user could get an unprivileged shell pod on the management cluster; CVE-2026-88809 (high), a meta proxy allowlist bypass leading to server-side request forgery; CVE-2026-88811 (high), where the meta proxy leaked the caller's Rancher credentials to third-party cloud provider hosts; and CVE-2026-88810, a GlobalRole RBAC escalation fixed in v2.15.3.",
  "language": "en",
  "_pwn": {
    "slug": "rancher-fleet-oct-2026-security-release-cluster-admin-escalation",
    "severity": "critical",
    "status": "live",
    "patchStatus": "patched",
    "rss": "https://pwn.watch/i/rancher-fleet-oct-2026-security-release-cluster-admin-escalation/feed.xml",
    "llms": "https://pwn.watch/i/rancher-fleet-oct-2026-security-release-cluster-admin-escalation/llms.txt",
    "json": "https://pwn.watch/i/rancher-fleet-oct-2026-security-release-cluster-admin-escalation.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/rancher-fleet-oct-2026-security-release-cluster-admin-escalation#2026-10-29-23393ab3",
      "url": "https://pwn.watch/i/rancher-fleet-oct-2026-security-release-cluster-admin-escalation#2026-10-29-23393ab3",
      "title": "Rancher and Fleet October 2026 security release: any Rancher user could become cluster-admin on the management cluster (CVE-2026-94290): SUSE releases Rancher Manager v2.15.3, v2.14.7, v2.13.11, v2.12.15 and v2.11.19 with Fleet v0.16.3, v0.15.8, v0.14.12 and v0.13.17, fixing six CVEs, and publishes GitHub advisories, including critical CVE-2026-94290 (any Rancher user to cluster-admin on the local cluster through Fleet's agent management controller).",
      "content_text": "Rancher and Fleet October 2026 security release: any Rancher user could become cluster-admin on the management cluster (CVE-2026-94290): SUSE releases Rancher Manager v2.15.3, v2.14.7, v2.13.11, v2.12.15 and v2.11.19 with Fleet v0.16.3, v0.15.8, v0.14.12 and v0.13.17, fixing six CVEs, and publishes GitHub advisories, including critical CVE-2026-94290 (any Rancher user to cluster-admin on the local cluster through Fleet's agent management controller).\n\nSource: https://documentation.suse.com/cloudnative/rancher-manager/v2.15/en/security/cves.html",
      "date_published": "2026-10-29T00:00:00.000Z",
      "external_url": "https://documentation.suse.com/cloudnative/rancher-manager/v2.15/en/security/cves.html",
      "tags": [
        "critical"
      ]
    }
  ]
}