{"id":"CVE-2026-93538","summary":"Cross-tenant BundleDeployment and Secret disclosure via spoofed cluster labels during agent-initiated registration in Fleet","details":"A cross-tenant authorization issue was discovered in SUSE Rancher Fleet. During agent-initiated cluster registration, cluster labels supplied by the registering agent, including labels in the reserved management.cattle.io/ namespace such as the cluster display name label, were applied to the resulting upstream Cluster object. Because Fleet resolves GitRepo and Bundle targets from those cluster labels, a party able to register a cluster into a Fleet workspace namespace shared with other tenants could cause its own cluster to satisfy targeting rules that administrators intended for a different cluster.\nThis affects SUSE Rancher Fleet 0.16 before 0.16.1, 0.15 before 0.15.6, 0.14 before 0.14.10, 0.13 before 0.13.15, 0.12 before 0.12.19 and older versions.","aliases":["GHSA-h9p5-fp5h-qpqr"],"modified":"2026-10-01T03:30:54.802481744Z","published":"2026-09-28T14:10:21.720Z","database_specific":{"cwe_ids":["CWE-290","CWE-639"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93538.json","cna_assigner":"suse"},"references":[{"type":"WEB","url":"https://github.com/rancher/fleet/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93538.json"},{"type":"ADVISORY","url":"https://github.com/rancher/fleet/security/advisories/GHSA-h9p5-fp5h-qpqr"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93538"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/rancher/fleet","events":[{"introduced":"c1a4325041578226f4f333b9f05d651ee4b03577"},{"fixed":"5823543a3d33952b1c7868eb035ad8e15db420fc"},{"introduced":"c63dc4bb52acb88fea50fe1b5f20db7f3ca6c9d9"},{"fixed":"ea6c08e5a3a77f34effe4136656acb88556ffd78"},{"introduced":"53de8d76a46c737f4b055dd1a7f2b7ac682537c5"},{"fixed":"98e6b68903f0bd96c1c289838ffaaf27a4b54b1b"},{"introduced":"e0324f2d4c06dad05a298622a1276ea596367b6a"},{"fixed":"bde240cf8eb3122dd2a7e65849e8e30e74d1bdff"},{"introduced":"3d1fa6c06ff392c9fa66ca2f46831e2dae23bc16"},{"fixed":"3d1766d5b737501e0386d25558ebc87da867f77a"}],"database_specific":{"extracted_events":[{"introduced":"0.16.0"},{"fixed":"0.16.1"},{"introduced":"0.15.0"},{"fixed":"0.15.6"},{"introduced":"0.14.0"},{"fixed":"0.14.10"},{"introduced":"0.13.0"},{"fixed":"0.13.15"},{"introduced":"0.12.0"},{"fixed":"0.12.19"}],"source":"AFFECTED_FIELD"}}],"versions":["v0.14.10-rc.1","v0.13.15-rc.1","v0.13.14-rc.2","v0.13.14","pkg/apis/v0.13.14","v0.12.18-rc.2","v0.12.18","pkg/apis/v0.12.18","v0.16.1-beta.2","v0.16.1-beta.1","pkg/apis/v0.16.1-beta.1","v0.15.6-alpha.1","v0.14.9-rc.2","v0.14.9","pkg/apis/v0.14.9","v0.15.5-rc.2","v0.15.5","pkg/apis/v0.15.5","v0.16.0-rc.5","v0.16.0","pkg/apis/v0.16.0","v0.13.14-rc.1","v0.12.18-rc.1","v0.15.5-rc.1","v0.14.9-rc.1","v0.14.8","pkg/apis/v0.14.8","v0.12.17","pkg/apis/v0.12.17","v0.13.13","pkg/apis/v0.13.13","v0.15.4","pkg/apis/v0.15.4","v0.12.16","v0.14.7-rc.2","v0.14.7","v0.13.12-rc.1","v0.13.12","v0.12.16-rc.1","v0.15.3-rc.2","v0.15.3","v0.14.7-rc.1","v0.15.3-rc.1","v0.15.3-beta.2","v0.15.3-beta.1","v0.12.15-rc.3","v0.12.15","pkg/apis/v0.12.15-rc.3","pkg/apis/v0.12.15","v0.13.11-rc.2","v0.13.11","pkg/apis/v0.13.11-rc.2","pkg/apis/v0.13.11","v0.14.6-rc.3","v0.14.6","pkg/apis/v0.14.6-rc.3","pkg/apis/v0.14.6","v0.15.2-rc.3","v0.15.2","pkg/apis/v0.15.2-rc.3","pkg/apis/v0.15.2","v0.15.2-rc.2","pkg/apis/v0.15.2-rc.2","v0.12.15-rc.2","pkg/apis/v0.12.15-rc.2","v0.14.6-rc.2","pkg/apis/v0.14.6-rc.2","v0.13.11-rc.1","pkg/apis/v0.13.11-rc.1","v0.12.15-rc.1","v0.14.6-rc.1","v0.14.5-rc.2","v0.14.5","v0.13.10-rc.2","v0.13.10","v0.15.2-rc.1","v0.12.14-rc.2","v0.12.14","v0.15.1-rc.2","v0.15.1","v0.12.14-rc.1","v0.15.1-rc.1","v0.14.5-rc.1","v0.13.10-rc.1","v0.12.14-beta.4","v0.13.10-beta.5","v0.14.5-beta.5","v0.15.1-beta.4","v0.13.10-beta.4","v0.12.14-beta.3","v0.14.5-beta.4","v0.14.5-beta.3","v0.15.1-beta.3","v0.13.10-beta.3","v0.12.14-beta.2","v0.13.10-beta.2","v0.15.1-beta.2","v0.14.5-beta.2","v0.13.10-beta.1","v0.12.14-beta.1","v0.14.5-beta.1","v0.15.1-beta.1","v0.13.9-rc.4","v0.13.9","v0.12.13-rc.3","v0.12.13","v0.14.4-rc.5","v0.14.4","v0.15.0-rc.6","v0.15.0","pkg/apis/v0.15.0","v0.14.4-rc.4","v0.13.9-rc.3","v0.12.13-rc.2","v0.14.4-rc.3","v0.13.9-rc.1","v0.12.13-rc.1","v0.14.4-rc.2","v0.14.4-rc.1","v0.14.4-beta.2","v0.14.4-beta.1","v0.14.3-rc.3","v0.14.3","v0.12.12-rc.2","v0.12.12","pkg/apis/v0.12.12-rc.2","v0.13.8-rc.1","v0.13.8","v0.14.3-rc.2","v0.12.12-rc.1","v0.14.3-rc.1","v0.12.11-rc.3","v0.12.11","v0.13.7-rc.2","v0.13.7","pkg/apis/v0.13.7-rc.2","pkg/apis/v0.13.7","v0.14.3-beta.1","v0.14.2-rc.2","v0.14.2","pkg/apis/v0.14.2-rc.2","pkg/apis/v0.14.2","v0.14.2-rc.1","pkg/apis/v0.14.2-rc.1","v0.12.11-rc.2","v0.13.7-rc.1","pkg/apis/v0.13.7-rc.1","v0.12.11-rc.1","v0.14.2-beta.1","pkg/apis/v0.14.2-beta.1","v0.13.7-alpha.2","v0.13.7-alpha.1","v0.13.6-rc.1","v0.13.6","v0.12.10-rc.1","v0.12.10","v0.14.1-rc.1","v0.14.1","v0.14.1-beta.4","v0.13.6-beta.1","v0.14.1-beta.3","v0.14.1-beta.2","v0.14.1-beta.1","v0.12.9","v0.13.5","v0.14.0","pkg/apis/v0.14.0","v0.13.4-rc.2","v0.13.4","v0.12.9-rc.2","v0.13.5-rc.3","v0.12.9-rc.1","v0.13.5-rc.2","v0.13.5-rc.1","v0.12.9-beta.2","v0.12.9-beta.1","v0.13.5-beta.1","v0.12.8-rc.1","v0.12.8","v0.13.4-rc.1","v0.12.7-rc.2","v0.12.7","v0.13.3","v0.13.2-rc.2","v0.13.2","v0.12.7-rc.1","v0.13.2-rc.1","v0.13.1-rc.6","v0.13.1-rc.5","v0.13.1","v0.13.0-rc.4","v0.13.0","pkg/apis/v0.13.0","v0.12.6-rc.3","v0.12.6","v0.12.6-rc.2","v0.13.1-rc.4","v0.13.1-rc.3","v0.13.1-rc.2","v0.12.6-rc.1","v0.13.1-rc.1","v0.12.6-beta.2","v0.13.1-beta.2","v0.13.1-beta.1","v0.12.6-beta.1","v0.12.5-rc.1","v0.12.5","pkg/apis/v0.12.5","v0.12.4-rc.3","v0.12.4","v0.12.4-rc.2","v0.12.4-rc.1","v0.12.3-rc.1","v0.12.3","pkg/apis/v0.12.3-rc.1","pkg/apis/v0.12.3","v0.12.3-beta.1","pkg/apis/v0.12.3-beta.1","v0.12.2","v0.12.1-rc.1","v0.12.1","pkg/apis/v0.12.1-rc.1","pkg/apis/v0.12.1","v0.12.1-beta.2","v0.12.1-beta.1","pkg/apis/v0.12.1-beta.1","v0.12.0-rc.5","v0.12.0","pkg/apis/v0.12.0-rc.5","pkg/apis/v0.12.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-93538.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N"}]}