Rancher Fleet: Helm template preprocessing reaches the network, leaking cluster metadata via DNS

Impact

Fleet is the GitOps controller that pushes bundles from a management cluster out to downstream clusters, so it sits with broad read access to cluster metadata and a network position inside the management plane. Anyone who can land content in a repository referenced by a GitRepo can make the controller evaluate templates that resolve names off-cluster, turning the templating context into an exfiltration channel and the resolver into a reconnaissance tool for hosts reachable from the controller. Because the channel is DNS resolution rather than an outbound HTTP connection, it keeps working in the egress-restricted management clusters where operators assume this class of leak is already contained. SUSE limits the disclosure to values exposed to the templating context plus name-resolution results, and states that integrity and availability of managed clusters are not affected - this is an information-disclosure and internal-mapping bug, not a path to controlling downstream GPU clusters.

Who can reach it

Remote, authenticated in effect: a user who can commit or otherwise supply bundle content to any Git repository that a GitRepo resource already references. No access to the management cluster itself is needed - the controller pulls the content and evaluates it.

What to do

Upgrade the Fleet controller to 0.12.19, 0.13.15, 0.14.10, 0.15.6 or 0.16.1 depending on your branch. This is a management-cluster controller upgrade - the Fleet deployment restarts, GitOps reconciliation pauses for the rollout, and no downstream cluster or GPU node needs to be drained or rebooted. Until then, treat write access to every repository referenced by a GitRepo as equivalent to read access on the controller's templating context, and audit who holds it.

References

Related entries

• containerd: containerd-shim abstract-socket API exposed to host-network containersCVE-2020-15257 · containerdMedium
• Kubernetes (kube-apiserver): Aggregated API server can redirect apiserver clientsCVE-2022-3172 · Kubernetes (kube-apiserver)Medium
• Docker / moby: On firewalld reload, published container ports become reachable from outside despite the intendedCVE-2025-54388 · Docker / mobyMedium
• CRI-O: All pod processes share one memory cgroup, so a workload OOM kills conmon and destabilises the nodeCVE-2019-14891 · CRI-OMedium
• containerd: Crafted image can change Unix file permissions of existing host files during extractionCVE-2021-32760 · containerdMedium
• Istio: A user with CREATE on Gateway API resources escalates privilege in istiodCVE-2022-21701 · IstioMedium