Rancher Fleet: incomplete ServiceAccount impersonation lets a tenant read secrets on every targeted cluster

Impact

Two code paths in Fleet's Helm deployer did not fully apply the ServiceAccount impersonation that is supposed to confine a GitRepo to its assigned permissions. A tenant who can push to a Fleet-monitored repository therefore reads secrets from any namespace on every downstream cluster that their GitRepo targets. On a multi-tenant GPU estate managed by Rancher, that is a cross-tenant and cross-cluster secret read: registry pull credentials, storage keys, service-account tokens for namespaces running other customers' training jobs. The impersonation boundary is exactly what multi-tenant Fleet deployments rely on, so this removes the control, not just a layer of it.

Who can reach it

Any user with git push access to a repository referenced by a Fleet GitRepo - authenticated to the git host, no additional Kubernetes permissions on the downstream clusters needed.

What to do

Upgrade Fleet to the fixed version listed in the SUSE advisory and restart the Fleet controller; no node drain or GPU workload disruption. Until then, treat secrets in namespaces on any cluster targeted by a tenant-writable GitRepo as potentially read, and review who has push access to Fleet-monitored repositories. The record does not state the fixed version number - check the SUSE bugzilla entry and GHSA-765j-qfrp-hm3j for it.

References

Related entries

• LXD: newline injection in NVIDIA instance config yields code execution as the LXD daemonCVE-2026-63298 · Canonical LXD (NVIDIA instance configuration: nvidia.driver.capabilities, nvidia.require.*)Critical
• RHACM HelmRelease controller: tenant-supplied charts render with the controller's cluster-wide ServiceAccountCVE-2026-67567 · Red Hat Advanced Cluster Management multicloud-operators-subscription (HelmRelease controller)Critical
• Red Hat ACM: unvalidated ocm-managed-cluster annotation lets a hub tenant target any spoke clusterCVE-2026-72526 · Red Hat ACM multicloud-integrations (Argo CD Application propagation controller)Critical
• Dokploy: authenticated members inject shell commands into deploy and backup paths and get host rootCVE-2026-72736 · Dokploy (shell command construction in deploy, backup, git and destination endpoints)Critical
• Dokploy: WebSocket terminals authenticate but never authorize, giving any member a root shell in any containerCVE-2026-72863 · Dokploy WebSocket handlers (container terminal and log streaming)Critical
• Dokploy: swarm endpoints skip the tenant check and inject nodeId into a remote commandCVE-2026-72876 · Dokploy swarm API router (swarm.getNodes / getNodeInfo / getNodeApps / getAppInfos)Critical