attack vector is network; attack complexity is low; privileges required is low; user interaction is none; scope is changed; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products
suse Rancher and suse rancher_fleet
Classified as
CWE-863 (Incorrect Authorization)
Affected Products, Subsystems & Sectors
Vendor
Product
Affected Versions
Patch Status
suse
Rancher
suse
rancher_fleet
Subsystems
General OT
Sectors
Multiple
What to Know
Fleet's Helm deployer did not fully apply ServiceAccount impersonation in two code paths, allowing a tenant with git push access to a Fleet-monitored repository to read secrets from any namespace on every downstream cluster targeted by their `GitRepo`.
What to Do
Monitor suse's web page for any future patch releases. See vendor advisory link below.