{"id":"CVE-2026-41050","summary":"Helm impersonation bypass of `RESTClientGetter` retains `cluster-admin` during template rendering","details":"Fleet's Helm deployer did not fully apply ServiceAccount impersonation in two code paths, allowing a tenant with git push access to a Fleet-monitored repository to read secrets from any namespace on every downstream cluster targeted by their `GitRepo`.","aliases":["GHSA-765j-qfrp-hm3j","GO-2026-5207"],"modified":"2026-10-24T10:52:07.080364988Z","published":"2026-05-13T08:04:57.293Z","related":["openSUSE-SU-2026:21483-1"],"database_specific":{"cna_assigner":"suse","cwe_ids":["CWE-863"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41050.json","unresolved_ranges":[{"extracted_events":[{"range":[{"introduced":"0.15.0"},{"fixed":"0.15.1"},{"introduced":"0.14.0"},{"fixed":"0.14.5"},{"introduced":"0.13.0"},{"fixed":"0.13.10"},{"introduced":"0.12.0"},{"fixed":"0.12.14"},{"introduced":"0.11.0"},{"fixed":"0.11.13"}],"source":"AFFECTED_FIELD","strategy":"StandardRange"}]}]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41050.json"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-765j-qfrp-hm3j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41050"},{"type":"REPORT","url":"https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-41050"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/rancher/fleet","events":[{"introduced":"3e91ed3fb600e6499107751f7c3c0ab255f09640"},{"fixed":"978ddfd96082e35190fff4b23d6af643ca158dda"},{"introduced":"3d1fa6c06ff392c9fa66ca2f46831e2dae23bc16"},{"fixed":"1d20cfb6063b1f93e0816932ac59a7b5902c2dae"},{"introduced":"e0324f2d4c06dad05a298622a1276ea596367b6a"},{"fixed":"8e4aa2e49569a9e9c8ee06e940f90e93c0900c65"},{"introduced":"53de8d76a46c737f4b055dd1a7f2b7ac682537c5"},{"fixed":"778f3d32e29cd50f33c81a8f6e5ebda29ae737b1"},{"introduced":"c63dc4bb52acb88fea50fe1b5f20db7f3ca6c9d9"},{"fixed":"190f2815a2f6bb208d7ffd3b7da1c9f942716cc0"}],"database_specific":{"extracted_events":[{"source":"CPE_RANGE","cpe":"cpe:2.3:a:suse:rancher_fleet:*:*:*:*:*:*:*:*","range":[{"introduced":"0.11.0"},{"fixed":"0.11.13"}]},{"cpe":"cpe:2.3:a:suse:rancher_fleet:*:*:*:*:*:*:*:*","range":[{"introduced":"0.12.0"},{"fixed":"0.12.14"}],"source":"CPE_RANGE"},{"source":"CPE_RANGE","cpe":"cpe:2.3:a:suse:rancher_fleet:*:*:*:*:*:*:*:*","range":[{"introduced":"0.13.0"},{"fixed":"0.13.10"}]},{"range":[{"introduced":"0.14.0"},{"fixed":"0.14.5"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:suse:rancher_fleet:*:*:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:suse:rancher_fleet:*:*:*:*:*:*:*:*","range":[{"introduced":"0.15.0"},{"fixed":"0.15.1"}],"source":"CPE_RANGE"}]}}],"versions":["v0.11.13-beta.4","v0.12.14-rc.1","v0.15.1-rc.1","v0.14.5-rc.1","v0.13.10-rc.1","v0.12.14-beta.4","v0.13.10-beta.5","v0.14.5-beta.5","v0.15.1-beta.4","v0.13.10-beta.4","v0.12.14-beta.3","v0.14.5-beta.4","v0.14.5-beta.3","v0.15.1-beta.3","v0.13.10-beta.3","v0.11.13-beta.3","v0.12.14-beta.2","v0.13.10-beta.2","v0.15.1-beta.2","v0.14.5-beta.2","v0.13.10-beta.1","v0.12.14-beta.1","v0.11.13-beta.2","v0.14.5-beta.1","v0.15.1-beta.1","v0.13.9-rc.4","v0.13.9","v0.12.13-rc.3","v0.12.13","v0.14.4-rc.5","v0.14.4","v0.15.0-rc.6","v0.15.0","pkg/apis/v0.15.0","v0.14.4-rc.4","v0.13.9-rc.3","v0.12.13-rc.2","v0.14.4-rc.3","v0.13.9-rc.1","v0.12.13-rc.1","v0.11.13-beta.1","v0.14.4-rc.2","v0.14.4-rc.1","v0.14.4-beta.2","v0.14.4-beta.1","v0.14.3-rc.3","v0.14.3","v0.12.12-rc.2","v0.12.12","pkg/apis/v0.12.12-rc.2","v0.13.8-rc.1","v0.13.8","v0.14.3-rc.2","v0.12.12-rc.1","v0.14.3-rc.1","v0.11.12-rc.3","v0.11.12","pkg/apis/v0.11.12","v0.12.11-rc.3","v0.12.11","v0.13.7-rc.2","v0.13.7","pkg/apis/v0.13.7-rc.2","pkg/apis/v0.13.7","v0.14.3-beta.1","v0.14.2-rc.2","v0.14.2","pkg/apis/v0.14.2-rc.2","pkg/apis/v0.14.2","v0.14.2-rc.1","pkg/apis/v0.14.2-rc.1","v0.12.11-rc.2","v0.11.12-rc.2","v0.13.7-rc.1","pkg/apis/v0.13.7-rc.1","v0.11.12-rc.1","pkg/apis/v0.11.12-rc.1","v0.12.11-rc.1","v0.14.2-beta.1","pkg/apis/v0.14.2-beta.1","v0.13.7-alpha.2","v0.13.7-alpha.1","v0.13.6-rc.1","v0.13.6","v0.12.10-rc.1","v0.12.10","v0.14.1-rc.1","v0.14.1","v0.14.1-beta.4","v0.13.6-beta.1","v0.14.1-beta.3","v0.14.1-beta.2","v0.14.1-beta.1","v0.12.9","v0.13.5","v0.14.0","pkg/apis/v0.14.0","v0.13.4-rc.2","v0.13.4","v0.12.9-rc.2","v0.13.5-rc.3","v0.12.9-rc.1","v0.13.5-rc.2","v0.13.5-rc.1","v0.12.9-beta.2","v0.12.9-beta.1","v0.13.5-beta.1","v0.12.8-rc.1","v0.12.8","v0.13.4-rc.1","v0.12.7-rc.2","v0.12.7","v0.13.3","v0.11.11-rc.1","v0.11.11","v0.13.2-rc.2","v0.13.2","v0.12.7-rc.1","v0.13.2-rc.1","v0.13.1-rc.6","v0.13.1-rc.5","v0.13.1","v0.13.0-rc.4","v0.13.0","pkg/apis/v0.13.0","v0.12.6-rc.3","v0.12.6","v0.11.10-rc.4","v0.11.10","v0.12.6-rc.2","v0.13.1-rc.4","v0.11.10-rc.3","v0.13.1-rc.3","v0.11.10-rc.2","v0.13.1-rc.2","v0.11.10-rc.1","v0.12.6-rc.1","v0.13.1-rc.1","v0.12.6-beta.2","v0.13.1-beta.2","v0.13.1-beta.1","v0.12.6-beta.1","v0.12.5-rc.1","v0.12.5","pkg/apis/v0.12.5","v0.11.9-rc.2","v0.11.9","pkg/apis/v0.11.9","v0.12.4-rc.3","v0.12.4","v0.11.9-rc.1","pkg/apis/v0.11.9-rc.1","v0.12.4-rc.2","v0.12.4-rc.1","v0.11.8-rc.1","v0.11.8","pkg/apis/v0.11.8-rc.1","pkg/apis/v0.11.8","v0.12.3-rc.1","v0.12.3","pkg/apis/v0.12.3-rc.1","pkg/apis/v0.12.3","v0.11.8-beta.1","v0.12.3-beta.1","pkg/apis/v0.12.3-beta.1","v0.12.2","v0.11.7","v0.11.6-rc.2","v0.11.6","pkg/apis/v0.11.6","v0.12.1-rc.1","v0.12.1","pkg/apis/v0.12.1-rc.1","pkg/apis/v0.12.1","v0.11.6-rc.1","pkg/apis/v0.11.6-rc.1","v0.11.6-beta.2","v0.12.1-beta.2","v0.11.6-beta.1","pkg/apis/v0.11.6-beta.1","v0.12.1-beta.1","pkg/apis/v0.12.1-beta.1","v0.11.5","v0.12.0-rc.5","v0.12.0","pkg/apis/v0.12.0-rc.5","pkg/apis/v0.12.0","v0.11.4","v0.11.4-rc.2","v0.11.4-rc.1","v0.11.3-rc.2","v0.11.3","pkg/apis/v0.11.3","v0.11.3-rc.1","v0.11.3-beta.1","pkg/apis/v0.11.3-beta.1","v0.11.2-rc.2","v0.11.2","v0.11.2-rc.1","v0.11.1-rc.3","v0.11.1-rc.2","v0.11.1-rc.1","v0.11.1","v0.11.0-rc.4","v0.11.0","pkg/apis/v0.11.0-rc.4","pkg/apis/v0.11.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41050.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}]}