CVE-2026-93539

Medium

Description

A vulnerability was discovered in Fleet's Git webhook receiver (the gitjob webhook service). When a webhook secret is not configured, incoming webhook requests are accepted without verification, and processing a request can change the spec.pollingInterval field of a matching GitRepo resource in any namespace. A caller with network access to the webhook service and no Kubernetes credentials can therefore alter GitRepo configuration outside the namespaces they are authorized for. This only affects SUSE Rancher Fleet 0.16 before 0.16.2, older versions are not affected.

SeverityMedium

CVSS5.4

Exploit probability—

Product

Suse Rancher Fleet

PublishedSep 28, 2026

First seenSep 28, 2026

Weakness typeCWE-306Missing authentication for critical function

How to fix

Update

suse rancher_fleet0.16.2 or later

Vendor advisories

github.com/rancher/fleet/security/advisories/GHSA-8vfv-33cg-g75q

Affected products

Product	Affected versions	Fixed in
suse rancher_fleet	0.16.0 ≤ v < 0.16.2	0.16.2

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.