Rancher Fleet Cross-Namespace Secret Disclosure via Unvalidated valuesFrom References

union
  (
    AuditLogs
    | where OperationName has_any ("get", "list") and ResourceType has_any ("secrets", "configmaps")
    | where Properties has "fleet" or InitiatedBy has "fleet"
    | extend RequestedNamespace = tostring(parse_json(Properties).targetResources[0].displayName)
    | extend RequestingNamespace = tostring(parse_json(Properties).initiatedBy.app.displayName)
    | where RequestedNamespace != RequestingNamespace and isnotempty(RequestedNamespace) and isnotempty(RequestingNamespace)
    | project TimeGenerated, OperationName, ResourceType, RequestedNamespace, RequestingNamespace, CorrelationId, Result
  ),
  (
    KubeAuditEvent
    | where ObjectRef_Resource in ("secrets", "configmaps")
    | where User_Username startswith "system:serviceaccount" and User_Username contains "fleet"
    | where Verb in ("get", "list", "watch")
    | extend SourceNamespace = tostring(split(User_Username, ":")[2])
    | where ObjectRef_Namespace != SourceNamespace and isnotempty(ObjectRef_Namespace)
    | project TimeGenerated, Verb, ObjectRef_Namespace, ObjectRef_Name, ObjectRef_Resource, SourceNamespace, User_Username, RequestURI, ResponseStatus_Code
  )
| where ResponseStatus_Code == 200 or Result == "success"
| summarize CrossNamespaceAccessCount=count(), AffectedSecrets=make_set(ObjectRef_Name, 20) by bin(TimeGenerated, 5m), SourceNamespace, ObjectRef_Namespace, User_Username
| where CrossNamespaceAccessCount > 0

index=kubernetes sourcetype=kube:audit
| where object_ref.resource IN ("secrets", "configmaps")
| where verb IN ("get", "list", "watch")
| where like(user.username, "system:serviceaccount:%fleet%")
| eval source_namespace=mvindex(split(user.username, ":"), 2)
| where object_ref.namespace!=source_namespace AND isnotnull(object_ref.namespace) AND isnotnull(source_namespace)
| eval success=if(response_status.code==200 OR response_status.code==201, 1, 0)
| where success=1
| stats count AS cross_ns_reads, values(object_ref.name) AS accessed_secrets, values(object_ref.namespace) AS target_namespaces BY source_namespace, user.username, _time span=5m
| where cross_ns_reads > 0
| eval risk_score=case(cross_ns_reads > 10, 90, cross_ns_reads > 3, 70, true(), 50)
| sort -cross_ns_reads

sequence by kubernetes.audit.user.username with maxspan=10m
  [any where kubernetes.audit.objectRef.resource in ("bundles", "gitrepos") and kubernetes.audit.verb in ("create", "update", "patch") and kubernetes.audit.user.username : "*fleet*"]
  [any where kubernetes.audit.objectRef.resource in ("secrets", "configmaps") and kubernetes.audit.verb in ("get", "list") and kubernetes.audit.responseStatus.code == 200
    and kubernetes.audit.user.username : "system:serviceaccount:*fleet*"
    and kubernetes.audit.objectRef.namespace != kubernetes.audit.user.extra.authentication.kubernetes.io/pod-namespace]

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  username,
  "sourcehostname" AS cluster_node,
  QIDNAME(qid) AS event_name,
  payload
FROM events
WHERE LOGSOURCETYPENAME(logsourceid) ILIKE '%kubernetes%'
  AND (payload ILIKE '%"secrets"%' OR payload ILIKE '%"configmaps"%')
  AND (payload ILIKE '%"get"%' OR payload ILIKE '%"list"%')
  AND payload ILIKE '%system:serviceaccount%'
  AND payload ILIKE '%fleet%'
  AND payload ILIKE '%"code":200%'
  AND username NOT ILIKE 'system:masters'
LAST 30 MINUTES
ORDER BY starttime DESC

_sourceCategory=kubernetes/audit
| json field=_raw "verb" as verb
| json field=_raw "objectRef.resource" as resource
| json field=_raw "user.username" as username
| json field=_raw "objectRef.namespace" as target_namespace
| json field=_raw "responseStatus.code" as status_code
| where resource in ("secrets", "configmaps")
| where verb in ("get", "list", "watch")
| where username matches "*system:serviceaccount*fleet*"
| where status_code == "200"
| parse regex field=username "system:serviceaccount:(?<source_namespace>[^:]+):"
| where target_namespace != source_namespace and !isNull(target_namespace) and !isNull(source_namespace)
| count by username, source_namespace, target_namespace, resource
| sort by _count desc

rule rancher_fleet_cve_2026_44935_cross_namespace_secret_read {
  meta:
    author = "df00tech"
    description = "Detects Rancher Fleet cross-namespace secret disclosure CVE-2026-44935"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://github.com/rancher/fleet/security/advisories/GHSA-xr65-5cpm-g36x"

  events:
    $e.metadata.event_type = "USER_RESOURCE_ACCESS"
    $e.target.resource.type = "KUBERNETES_OBJECT"
    $e.target.resource.resource_subtype in ("secrets", "configmaps")
    $e.network.http.method in ("GET", "LIST")
    $e.principal.user.userid matches /system:serviceaccount:.*fleet.*/
    $e.network.http.response_code = 200
    $source_ns = re.capture($e.principal.user.userid, "system:serviceaccount:([^:]+):")
    $e.target.namespace != $source_ns
    $e.target.namespace != ""

  match:
    $e.principal.user.userid over 5m

  outcome:
    $risk_score = 85
    $target_namespace = $e.target.namespace
    $source_namespace = $source_ns
    $secret_name = $e.target.resource.name

  condition:
    $e
}

#event_simpleName=KubernetesAuditEvent
| verb IN ("get", "list", "watch")
| objectRefResource IN ("secrets", "configmaps")
| userUsername = /system:serviceaccount:.*fleet.*/i
| responseStatusCode = 200
| eval source_namespace=replace(userUsername, /system:serviceaccount:([^:]+):.*/, "\\1")
| where objectRefNamespace != source_namespace AND isNotNull(objectRefNamespace)
| stats count() AS cross_ns_count, values(objectRefName) AS secret_names, values(objectRefNamespace) AS target_namespaces BY userUsername, source_namespace, ClusterName
| where cross_ns_count > 0
| sort -cross_ns_count