CVE-2026-44938

Last refreshed2026-10-23

Status: UPDATED | Advisory ID: CVE-2026-44938

Key Details

CVE	CVE-2026-44938
CVSS Score / Version	8.8 (High) / CVSS v3.1
Updated	2026-10-20
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
CVSS Prose	attack vector is network; attack complexity is low; privileges required is low; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products	suse Rancher and suse rancher_fleet
Classified as	CWE-522 (Insufficiently Protected Credentials)

Affected Products, Subsystems & Sectors

Vendor	Product	Affected Versions	Patch Status
suse	Rancher
suse	rancher_fleet

Vendor

Product

Affected Versions

Patch Status

suse

Rancher

suse

rancher_fleet

Subsystems	General OT
Sectors	Multiple

What to Know

A vulnerability has been identified in Fleet's agent-side deployer, which did not filter security-sensitive keys from namespaceLabels in fleet.yaml (or BundleDeployment.spec.options.namespaceLabels) when applying them to the target namespace.

An attacker with git push access to a

Fleet-monitored repository could overwrite Pod Security Standards (PSS)

enforcement labels on a target namespace. This allows the attacker to

weaken admission controls and deploy workloads that PSS policies would

otherwise block. (NVD)

What to Do

Monitor suse's web page for any future patch releases. See vendor advisory link below.

References

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-44938
CVE	https://www.cve.org/CVERecord?id=CVE-2026-44938
Vendor advisory	https://github.com/advisories/GHSA-864g-863m-vcvq

Source

Reference

NVD

https://nvd.nist.gov/vuln/detail/CVE-2026-44938

CVE

https://www.cve.org/CVERecord?id=CVE-2026-44938

Vendor advisory

https://github.com/advisories/GHSA-864g-863m-vcvq