Rancher and Fleet October 2026 security release: any Rancher user could become cluster-admin on the management cluster (CVE-2026-94290) ยท updates https://pwn.watch/i/rancher-fleet-oct-2026-security-release-cluster-admin-escalation SUSE shipped Rancher Manager v2.15.3, v2.14.7, v2.13.11, v2.12.15 and v2.11.19 with Fleet v0.16.3, v0.15.8, v0.14.12 and v0.13.17 on Oct 29 2026, fixing six vulnerabilities. The worst is CVE-2026-94290 (CVSS 4.0 9.4 critical) in Fleet's agent management controller, which runs on the Rancher local cluster as cluster-admin: it did not restrict which kubeconfig secrets a Fleet Cluster object could reference, so an authenticated Rancher user with only the default user global role could get full cluster-admin on the management cluster, exposing every secret there, including credentials for all downstream clusters. Fleet is enabled by default in Rancher. The release also fixes CVE-2026-104615 (high), a Fleet cluster identity takeover where a holder of a workspace registration token could claim another cluster's identity and read Secrets and ConfigMaps synced into its Fleet namespace; CVE-2026-104623 (medium), where any authenticated user could get an unprivileged shell pod on the management cluster; CVE-2026-88809 (high), a meta proxy allowlist bypass leading to server-side request forgery; CVE-2026-88811 (high), where the meta proxy leaked the caller's Rancher credentials to third-party cloud provider hosts; and CVE-2026-88810, a GlobalRole RBAC escalation fixed in v2.15.3. en Thu, 29 Oct 2026 00:00:00 GMT Rancher and Fleet October 2026 security release: any Rancher user could become cluster-admin on the management cluster (CVE-2026-94290): SUSE releases Rancher Manager v2.15.3, v2.14.7, v2.13.11, v2.12.15 and v2.11.19 with Fleet v0.16.3, v0.15.8, v0.14.12 and v0.13.17, fixing six CVEs, and publishes GitHub advisories, including critical CVE-2026-94290 (any Rancher user to cluster-admin on the local cluster through Fleet's agent management controller). https://pwn.watch/i/rancher-fleet-oct-2026-security-release-cluster-admin-escalation https://pwn.watch/i/rancher-fleet-oct-2026-security-release-cluster-admin-escalation#2026-10-29-23393ab3 Thu, 29 Oct 2026 00:00:00 GMT critical <p><a href="https://documentation.suse.com/cloudnative/rancher-manager/v2.15/en/security/cves.html">Source</a></p>