GO-2026-5207
Fleet: Helm impersonation bypass of `RESTClientGetter` retains `cluster-admin` during template rendering in github.com/rancher/fleet
At a glance
- Published
- Updated
- CVE
- CVE-2026-41050
- Aliases
- GHSA-765j-qfrp-hm3j
Description
Fleet: Helm impersonation bypass of `RESTClientGetter` retains `cluster-admin` during template rendering in github.com/rancher/fleet
Affected packages
| Package | Versions |
|---|---|
| Go · github.com/rancher/fleet | introduced 0.11.0, fixed 0.11.13, introduced 0.12.0, fixed 0.12.14, introduced 0.13.0, fixed 0.13.10, introduced 0.14.0, fixed 0.14.5, introduced 0.15.0, fixed 0.15.1 |
References
- https://github.com/rancher/fleet/security/advisories/GHSA-765j-qfrp-hm3j ADVISORY
- https://nvd.nist.gov/vuln/detail/CVE-2026-41050 ADVISORY
- https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-41050 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |