PT-2026-54763 · Suse · Rancher Fleet

Published 2026-07-01 · Updated 2026-07-07 · CVE-2026-44938

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Rancher Fleet (affected versions not specified)

Description An authentication bypass exists in the webhook component. Additionally, a Pod Security Standard (PSS) bypass can be achieved through the manipulation of namespace labels.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2026-44938

GHSA-864G-863M-VCVQ

GO-2026-5871

Affected Products

Rancher Fleet

References · 9

• https://osv.dev/vulnerability/GO-2026-5871 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-864g-863m-vcvq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44938 · Security Note
• https://github.com/rancher/fleet · Note
• https://github.com/rancher/fleet/security/advisories/GHSA-864g-863m-vcvq · Note
• https://twitter.com/dailycve/status/2072465881074934168 · Twitter Post
• https://twitter.com/dailycve/status/2072465660018376799 · Twitter Post
• https://github.com/advisories/GHSA-864g-863m-vcvq · Note
• https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-44938 · Note