Rancher Fleet: missing valuesFrom validation lets one tenant read another tenant's Fleet credentials

Impact

Fleet is the GitOps controller that many Rancher-managed GPU clusters use to push workloads to downstream clusters. The Helm Deployer does not validate valuesFrom references, so the owner of one Fleet tenant can point a bundle at secrets belonging to another tenant and read them. Those secrets are typically git credentials, registry pulls and cluster-registration tokens, so the payoff is control over another tenant's deployment pipeline rather than a single leaked value. On a shared GPU estate where tenants are separated by Fleet workspaces, this collapses that boundary.

Who can reach it

An authenticated user who owns a Fleet tenant/workspace and can create or edit a bundle - no cluster-admin and no node access needed. Network reach to the Rancher management API is enough.

What to do

Upgrade Fleet to 0.15.2, 0.14.6, 0.13.11 or 0.12.15 depending on your branch. This is a controller upgrade in the management cluster - the Fleet controller pods restart, in-flight bundle reconciles retry, and GPU workloads already running are untouched. No node drain or reboot. Treat any credential reachable via valuesFrom in a multi-tenant workspace as potentially exposed and rotate it.

References

Related entries

• Oracle TimesTen In-Memory Database: Kubernetes Operator flaw gives a low-privileged user full takeoverCVE-2026-60402 · Oracle TimesTen In-Memory Database (Kubernetes Operator)Critical
• LXD: newline injection in NVIDIA instance config yields code execution as the LXD daemonCVE-2026-63298 · Canonical LXD (NVIDIA instance configuration: nvidia.driver.capabilities, nvidia.require.*)Critical
• RHACM HelmRelease controller: tenant-supplied charts render with the controller's cluster-wide ServiceAccountCVE-2026-67567 · Red Hat Advanced Cluster Management multicloud-operators-subscription (HelmRelease controller)Critical
• Red Hat ACM: unvalidated ocm-managed-cluster annotation lets a hub tenant target any spoke clusterCVE-2026-72526 · Red Hat ACM multicloud-integrations (Argo CD Application propagation controller)Critical
• Dokploy: authenticated members inject shell commands into deploy and backup paths and get host rootCVE-2026-72736 · Dokploy (shell command construction in deploy, backup, git and destination endpoints)Critical
• Dokploy: WebSocket terminals authenticate but never authorize, giving any member a root shell in any containerCVE-2026-72863 · Dokploy WebSocket handlers (container terminal and log streaming)Critical