CVE-2026-93539
Unauthenticated GitRepo Spec Mutation via Fleet Git Webhook Receiver
CVSS Score
5.4
EPSS Score
0.0%
EPSS Percentile
0th
A vulnerability was discovered in Fleet's Git webhook receiver (the gitjob webhook service). When a webhook secret is not configured, incoming webhook requests are accepted without verification, and processing a request can change the spec.pollingInterval field of a matching GitRepo resource in any namespace. A caller with network access to the webhook service and no Kubernetes credentials can therefore alter GitRepo configuration outside the namespaces they are authorized for. This only affects SUSE Rancher Fleet 0.16 before 0.16.2, older versions are not affected.
| CWE | CWE-306 |
| Vendor | suse |
| Product | rancher |
| Published | Sep 28, 2026 |
Stay Ahead of the Next One
Get instant alerts for suse rancher
Be the first to know when new medium vulnerabilities affecting suse rancher are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
Low
Affected Versions
SUSE / Rancher
0.16.0 < 0.16.2
References
Credits
https://github.com/Pig-Tail