{"id":"CVE-2026-44938","summary":"Fleet has PSS Bypass through addLabelsFromOptions in Fleet Agent","details":"A vulnerability has been identified in Fleet's agent-side deployer, which did not filter security-sensitive keys from namespaceLabels in fleet.yaml (or BundleDeployment.spec.options.namespaceLabels) when applying them to the target namespace.\n\n\n\n\nAn attacker with git push access to a\n Fleet-monitored repository could overwrite Pod Security Standards (PSS)\n enforcement labels on a target namespace. This allows the attacker to \nweaken admission controls and deploy workloads that PSS policies would \notherwise block.","aliases":["GHSA-864g-863m-vcvq","GO-2026-5871"],"modified":"2026-10-24T10:51:13.628818630Z","published":"2026-07-07T13:05:03.344Z","related":["openSUSE-SU-2026:21483-1"],"database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44938.json","unresolved_ranges":[{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StandardRange","range":[{"introduced":"0.15.0"},{"fixed":"0.15.2"},{"introduced":"0.14.0"},{"fixed":"0.14.6"},{"introduced":"0.13.0"},{"fixed":"0.13.11"},{"introduced":"0.12.0"},{"fixed":"0.12.15"}]}]}],"cna_assigner":"suse","cwe_ids":["CWE-522"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44938.json"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-864g-863m-vcvq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44938"},{"type":"REPORT","url":"https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-44938"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/rancher/fleet","events":[{"introduced":"3d1fa6c06ff392c9fa66ca2f46831e2dae23bc16"},{"fixed":"8fc0388c9703d4ade55e9a103153085f585a3d03"},{"introduced":"e0324f2d4c06dad05a298622a1276ea596367b6a"},{"fixed":"9cc729f7dc0b9055938115103581a968a287bccf"},{"introduced":"53de8d76a46c737f4b055dd1a7f2b7ac682537c5"},{"fixed":"e423b88b67752ef11d3607a26b41e57a90859abe"},{"introduced":"c63dc4bb52acb88fea50fe1b5f20db7f3ca6c9d9"},{"fixed":"c8932b5fc204c3f36026d0fabdf41f740873526c"}],"database_specific":{"extracted_events":[{"cpe":"cpe:2.3:a:suse:rancher_fleet:*:*:*:*:*:*:*:*","range":[{"introduced":"0.12.0"},{"fixed":"0.12.15"}],"source":"CPE_RANGE"},{"range":[{"introduced":"0.13.0"},{"fixed":"0.13.11"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:suse:rancher_fleet:*:*:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:suse:rancher_fleet:*:*:*:*:*:*:*:*","range":[{"introduced":"0.14.0"},{"fixed":"0.14.6"}],"source":"CPE_RANGE"},{"range":[{"introduced":"0.15.0"},{"fixed":"0.15.2"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:suse:rancher_fleet:*:*:*:*:*:*:*:*"}]}}],"versions":["v0.15.2-rc.2","pkg/apis/v0.15.2-rc.2","v0.12.15-rc.2","pkg/apis/v0.12.15-rc.2","v0.14.6-rc.2","pkg/apis/v0.14.6-rc.2","v0.13.11-rc.1","pkg/apis/v0.13.11-rc.1","v0.12.15-rc.1","v0.14.6-rc.1","v0.14.5-rc.2","v0.14.5","v0.13.10-rc.2","v0.13.10","v0.15.2-rc.1","v0.12.14-rc.2","v0.12.14","v0.15.1-rc.2","v0.15.1","v0.12.14-rc.1","v0.15.1-rc.1","v0.14.5-rc.1","v0.13.10-rc.1","v0.12.14-beta.4","v0.13.10-beta.5","v0.14.5-beta.5","v0.15.1-beta.4","v0.13.10-beta.4","v0.12.14-beta.3","v0.14.5-beta.4","v0.14.5-beta.3","v0.15.1-beta.3","v0.13.10-beta.3","v0.12.14-beta.2","v0.13.10-beta.2","v0.15.1-beta.2","v0.14.5-beta.2","v0.13.10-beta.1","v0.12.14-beta.1","v0.14.5-beta.1","v0.15.1-beta.1","v0.13.9-rc.4","v0.13.9","v0.12.13-rc.3","v0.12.13","v0.14.4-rc.5","v0.14.4","v0.15.0-rc.6","v0.15.0","pkg/apis/v0.15.0","v0.14.4-rc.4","v0.13.9-rc.3","v0.12.13-rc.2","v0.14.4-rc.3","v0.13.9-rc.1","v0.12.13-rc.1","v0.14.4-rc.2","v0.14.4-rc.1","v0.14.4-beta.2","v0.14.4-beta.1","v0.14.3-rc.3","v0.14.3","v0.12.12-rc.2","v0.12.12","pkg/apis/v0.12.12-rc.2","v0.13.8-rc.1","v0.13.8","v0.14.3-rc.2","v0.12.12-rc.1","v0.14.3-rc.1","v0.12.11-rc.3","v0.12.11","v0.13.7-rc.2","v0.13.7","pkg/apis/v0.13.7-rc.2","pkg/apis/v0.13.7","v0.14.3-beta.1","v0.14.2-rc.2","v0.14.2","pkg/apis/v0.14.2-rc.2","pkg/apis/v0.14.2","v0.14.2-rc.1","pkg/apis/v0.14.2-rc.1","v0.12.11-rc.2","v0.13.7-rc.1","pkg/apis/v0.13.7-rc.1","v0.12.11-rc.1","v0.14.2-beta.1","pkg/apis/v0.14.2-beta.1","v0.13.7-alpha.2","v0.13.7-alpha.1","v0.13.6-rc.1","v0.13.6","v0.12.10-rc.1","v0.12.10","v0.14.1-rc.1","v0.14.1","v0.14.1-beta.4","v0.13.6-beta.1","v0.14.1-beta.3","v0.14.1-beta.2","v0.14.1-beta.1","v0.12.9","v0.13.5","v0.14.0","pkg/apis/v0.14.0","v0.13.4-rc.2","v0.13.4","v0.12.9-rc.2","v0.13.5-rc.3","v0.12.9-rc.1","v0.13.5-rc.2","v0.13.5-rc.1","v0.12.9-beta.2","v0.12.9-beta.1","v0.13.5-beta.1","v0.12.8-rc.1","v0.12.8","v0.13.4-rc.1","v0.12.7-rc.2","v0.12.7","v0.13.3","v0.13.2-rc.2","v0.13.2","v0.12.7-rc.1","v0.13.2-rc.1","v0.13.1-rc.6","v0.13.1-rc.5","v0.13.1","v0.13.0-rc.4","v0.13.0","pkg/apis/v0.13.0","v0.12.6-rc.3","v0.12.6","v0.12.6-rc.2","v0.13.1-rc.4","v0.13.1-rc.3","v0.13.1-rc.2","v0.12.6-rc.1","v0.13.1-rc.1","v0.12.6-beta.2","v0.13.1-beta.2","v0.13.1-beta.1","v0.12.6-beta.1","v0.12.5-rc.1","v0.12.5","pkg/apis/v0.12.5","v0.12.4-rc.3","v0.12.4","v0.12.4-rc.2","v0.12.4-rc.1","v0.12.3-rc.1","v0.12.3","pkg/apis/v0.12.3-rc.1","pkg/apis/v0.12.3","v0.12.3-beta.1","pkg/apis/v0.12.3-beta.1","v0.12.2","v0.12.1-rc.1","v0.12.1","pkg/apis/v0.12.1-rc.1","pkg/apis/v0.12.1","v0.12.1-beta.2","v0.12.1-beta.1","pkg/apis/v0.12.1-beta.1","v0.12.0-rc.5","v0.12.0","pkg/apis/v0.12.0-rc.5","pkg/apis/v0.12.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44938.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}