CVE-2026-44935: Cross-Namespace Secret Disclosure in Rancher Fleet's Helm Deployer

Overview

CVE-2026-44935 is a critical (CVSS 9.9) access-control flaw in Rancher Fleet's Helm Deployer, tracked under CWE-863: Incorrect Authorization. Fleet's GitOps controller resolves Helm valuesFrom references — which can point at a Secret or ConfigMap — without validating that the referenced object belongs to the same namespace or RBAC scope as the requesting Bundle/GitRepo. A low-privileged user who can only create GitRepo or Bundle resources in their own namespace can craft a valuesFrom reference pointing at a Secret or ConfigMap in an entirely different, unrelated namespace. Fleet dereferences it anyway and renders the secret's contents into the resolved Helm values, which then surface through helm get values, Bundle status output, or controller logs.

The impact is direct secret exfiltration across namespace boundaries — including cluster-admin kubeconfigs, cloud provider IAM keys, and Fleet's own agent tokens — effectively converting a scoped GitOps permission into a cluster-wide credential disclosure primitive.

Affected Software

The vulnerability affects github.com/rancher/fleet across multiple release lines:

• Fleet >= 0.15.0, < 0.15.2
• Fleet >= 0.14.0, < 0.14.6
• Fleet >= 0.13.0, < 0.13.11
• Fleet >= 0.12.0, < 0.12.15

No patched date has been published at the time of this write-up; treat all four affected lines as unresolved and prioritize compensating controls.

Exploitation Status

A public proof-of-concept exists (poc-public). This vulnerability has not been added to a known-exploited-vulnerabilities list and no confirmed weaponized campaign has been observed, but the combination of a public PoC, a low bar for exploitation (only Bundle/GitRepo creation rights are required), and catastrophic impact (cluster-admin credential theft) makes this a high-priority patching and detection target. Any tenant or team with GitOps authoring access in a multi-tenant Fleet-managed cluster should be treated as a potential attack vector until patched.

Detection Coverage

Our detection package ships coverage across Microsoft Sentinel (KQL), Splunk (SPL), Elastic (EQL), IBM QRadar (AQL), Sumo Logic, Google Chronicle (YARA-L), and CrowdStrike (CQL). The detection logic focuses on the anomalous cross-namespace reference pattern rather than any single log source:

• Kubernetes audit log events for GitRepo/Bundle create or update operations where the embedded valuesFrom field references a Secret or ConfigMap name resolving to a namespace different from the requesting resource's own namespace.
• Correlation between the identity/service account performing the Bundle write and the RBAC scope it holds, flagging cases where that identity has no legitimate read access to the target namespace.
• Downstream signals such as Fleet controller logs or Bundle status fields that expose rendered Helm values, used to confirm successful secret resolution rather than a failed or benign reference.

This layered approach lets defenders catch the exploitation attempt at the audit-log stage, before secret material is fully rendered and exposed.

Full Detection Details

For the complete KQL, SPL, and other SIEM queries, MITRE ATT&CK mapping, and remediation guidance, see the full detection page for CVE-2026-44935.