Fleet has PSS Bypass through addLabelsFromOptions in Fleet Agent

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

8.8 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

• CVE-2026-44938: 0.44% estimated exploitation activity in the next 30 days; percentile 38.49 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

Impact A vulnerability has been identified in Fleet's agent-side deployer, which did not filter security-sensitive keys from namespaceLabels in fleet.yaml (or BundleDeployment.spec.options.namespaceLabels) when applying them to the target namespace. An attacker with git push access to a Fleet-monitored repository could overwrite Pod Security Standards (PSS) enforcement labels on a target namespace. This allows the attacker to weaken admission controls and deploy workloads that PSS policies would otherwise block. Important: The final impact on confidentiality, integrity, and availability depends on the specific permissions of the leaked credentials. Fleet team recommends you: 1. Review your system for potentially leaked credentials. 2. Replace any credentials that may be compromised. Please consult the associated MITRE ATT&CK - Technique - Disable or Modify Tools for further information about this category of attack. Patches To fix this issue, upgrade to a patched version. The updated…

Published by the source

1 Jul 2026, 20:35 UTC

Last modified by the source

1 Jul 2026, 20:35 UTC

Source last checked

26 Oct 2026, 15:24 UTC

1. Revision 1 · created · 26 Oct 2026

   Published from ghsa record GHSA-864g-863m-vcvq

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2026-44938

Advisory: Fleet has PSS Bypass through addLabelsFromOptions in Fleet Agent
IDs: CVE-2026-44938, GHSA-864g-863m-vcvq
Record: https://patchnext.com/advisories/cve-2026-44938 (revision 1, source checked 26 Oct 2026, 15:24 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: High (CVSS 8.8)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: github.com/rancher/fleet 0.15.2, 0.14.6, 0.13.11, 0.12.15. A vendor fix does not mean a deployment is fixed.

## Affected components
- Go github.com/rancher/fleet: affected >= 0.15.0, < 0.15.2; >= 0.14.0, < 0.14.6; >= 0.13.0, < 0.13.11; >= 0.12.0, < 0.12.15; fixed in 0.12.15, 0.14.6, 0.15.2, 0.13.11

## Suggested inspection (read-only)
- Go github.com/rancher/fleet: check the installed version with your package manager.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on github.com/rancher/fleet.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-864g-863m-vcvq (GitHub-reviewed advisory GHSA-864g-863m-vcvq lists affected ranges: Go github.com/rancher/fleet >=0.15.0 =0.14.0 =0.13.0 =0.12.0 <0.12.15)

Commands are suggestions: review each one before running it.