{"id":"CVE-2026-44937","summary":"SUSE Rancher Fleet had an Unauthenticated Webhook: Regex Injection via Unsanitized Repository URL Components","details":"Potential forgery of webhook requests when using a unauthenticated webhook in SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.5 could be used by remote attackers to cause a denial of service or a downgrade attack on other repositories on the system.","aliases":["GHSA-jmf4-m7j9-g72r","GO-2026-5874"],"modified":"2026-07-15T01:49:01.463020619Z","published":"2026-07-06T09:52:18.659Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44937.json","cna_assigner":"suse","cwe_ids":["CWE-918"]},"references":[{"type":"WEB","url":"https://github.com/rancher/fleet/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44937.json"},{"type":"ADVISORY","url":"https://github.com/rancher/fleet/security/advisories/GHSA-jmf4-m7j9-g72r"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44937"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/rancher/fleet","events":[{"introduced":"3d1fa6c06ff392c9fa66ca2f46831e2dae23bc16"},{"fixed":"8fc0388c9703d4ade55e9a103153085f585a3d03"},{"introduced":"e0324f2d4c06dad05a298622a1276ea596367b6a"},{"fixed":"9cc729f7dc0b9055938115103581a968a287bccf"},{"introduced":"53de8d76a46c737f4b055dd1a7f2b7ac682537c5"},{"fixed":"e423b88b67752ef11d3607a26b41e57a90859abe"},{"introduced":"c63dc4bb52acb88fea50fe1b5f20db7f3ca6c9d9"},{"fixed":"c8932b5fc204c3f36026d0fabdf41f740873526c"}],"database_specific":{"cpe":"cpe:2.3:a:suse:rancher_fleet:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0.12.0"},{"fixed":"0.12.15"},{"introduced":"0.13.0"},{"fixed":"0.13.11"},{"introduced":"0.14.0"},{"fixed":"0.14.6"},{"introduced":"0.15.0"},{"fixed":"0.15.2"}],"source":"CPE_RANGE"}}],"versions":["v0.15.2-rc.2","pkg/apis/v0.15.2-rc.2","v0.12.15-rc.2","pkg/apis/v0.12.15-rc.2","v0.14.6-rc.2","pkg/apis/v0.14.6-rc.2","v0.13.11-rc.1","pkg/apis/v0.13.11-rc.1","v0.12.15-rc.1","v0.14.6-rc.1","v0.14.5-rc.2","v0.14.5","v0.13.10-rc.2","v0.13.10","v0.15.2-rc.1","v0.12.14-rc.2","v0.12.14","v0.15.1-rc.2","v0.15.1","v0.12.14-rc.1","v0.15.1-rc.1","v0.14.5-rc.1","v0.13.10-rc.1","v0.12.14-beta.4","v0.13.10-beta.5","v0.14.5-beta.5","v0.15.1-beta.4","v0.13.10-beta.4","v0.12.14-beta.3","v0.14.5-beta.4","v0.14.5-beta.3","v0.15.1-beta.3","v0.13.10-beta.3","v0.12.14-beta.2","v0.13.10-beta.2","v0.15.1-beta.2","v0.14.5-beta.2","v0.13.10-beta.1","v0.12.14-beta.1","v0.14.5-beta.1","v0.15.1-beta.1","v0.13.9-rc.4","v0.13.9","v0.12.13-rc.3","v0.12.13","v0.14.4-rc.5","v0.14.4","v0.15.0-rc.6","v0.15.0","pkg/apis/v0.15.0","v0.14.4-rc.4","v0.13.9-rc.3","v0.12.13-rc.2","v0.14.4-rc.3","v0.13.9-rc.1","v0.12.13-rc.1","v0.14.4-rc.2","v0.14.4-rc.1","v0.14.4-beta.2","v0.14.4-beta.1","v0.14.3-rc.3","v0.14.3","v0.12.12-rc.2","v0.12.12","pkg/apis/v0.12.12-rc.2","v0.13.8-rc.1","v0.13.8","v0.14.3-rc.2","v0.12.12-rc.1","v0.14.3-rc.1","v0.12.11-rc.3","v0.12.11","v0.13.7-rc.2","v0.13.7","pkg/apis/v0.13.7-rc.2","pkg/apis/v0.13.7","v0.14.3-beta.1","v0.14.2-rc.2","v0.14.2","pkg/apis/v0.14.2-rc.2","pkg/apis/v0.14.2","v0.14.2-rc.1","pkg/apis/v0.14.2-rc.1","v0.12.11-rc.2","v0.13.7-rc.1","pkg/apis/v0.13.7-rc.1","v0.12.11-rc.1","v0.14.2-beta.1","pkg/apis/v0.14.2-beta.1","v0.13.7-alpha.2","v0.13.7-alpha.1","v0.13.6-rc.1","v0.13.6","v0.12.10-rc.1","v0.12.10","v0.14.1-rc.1","v0.14.1","v0.14.1-beta.4","v0.13.6-beta.1","v0.14.1-beta.3","v0.14.1-beta.2","v0.14.1-beta.1","v0.12.9","v0.13.5","v0.14.0","pkg/apis/v0.14.0","v0.13.4-rc.2","v0.13.4","v0.12.9-rc.2","v0.13.5-rc.3","v0.12.9-rc.1","v0.13.5-rc.2","v0.13.5-rc.1","v0.12.9-beta.2","v0.12.9-beta.1","v0.13.5-beta.1","v0.12.8-rc.1","v0.12.8","v0.13.4-rc.1","v0.12.7-rc.2","v0.12.7","v0.13.3","v0.13.2-rc.2","v0.13.2","v0.12.7-rc.1","v0.13.2-rc.1","v0.13.1-rc.6","v0.13.1-rc.5","v0.13.1","v0.13.0-rc.4","v0.13.0","pkg/apis/v0.13.0","v0.12.6-rc.3","v0.12.6","v0.12.6-rc.2","v0.13.1-rc.4","v0.13.1-rc.3","v0.13.1-rc.2","v0.12.6-rc.1","v0.13.1-rc.1","v0.12.6-beta.2","v0.13.1-beta.2","v0.13.1-beta.1","v0.12.6-beta.1","v0.12.5-rc.1","v0.12.5","pkg/apis/v0.12.5","v0.12.4-rc.3","v0.12.4","v0.12.4-rc.2","v0.12.4-rc.1","v0.12.3-rc.1","v0.12.3","pkg/apis/v0.12.3-rc.1","pkg/apis/v0.12.3","v0.12.3-beta.1","pkg/apis/v0.12.3-beta.1","v0.12.2","v0.12.1-rc.1","v0.12.1","pkg/apis/v0.12.1-rc.1","pkg/apis/v0.12.1","v0.12.1-beta.2","v0.12.1-beta.1","pkg/apis/v0.12.1-beta.1","v0.12.0-rc.5","v0.12.0","pkg/apis/v0.12.0-rc.5","pkg/apis/v0.12.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44937.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N"}]}