Listen to this Post
CVE-2026-41050 is a critical privilege escalation vulnerability in Rancher Fleet that breaks the multi-tenant isolation model. The flaw exists in the Fleet Helm deployer, which fails to fully apply Kubernetes ServiceAccount impersonation in two specific code paths. This allows a tenant with only git push access to a Fleet-monitored repository to bypass intended security boundaries and read secrets from any namespace on every downstream cluster targeted by their GitRepo.
The technical root cause is improper handling of ServiceAccount context switching within the Fleet deployer. When processing `GitRepo` resources, the system should consistently enforce that all operations occur within the context of the tenant’s designated ServiceAccount and namespace. However, in two code paths, the deployer fails to properly establish or maintain these security contexts, executing operations with elevated privileges that extend beyond the intended scope.
An attacker can exploit this by using the `valuesFrom` field in a `fleet.yaml` file (via a `GitRepo` resource) or a `HelmOp` resource to read the contents of any secret on the downstream cluster, provided they know or can guess the name, namespace, and key. Additionally, they can deploy `HelmOp` and `Bundle` resources without being restricted to a specific service account for the Fleet agent. This fundamentally undermines the security model of multi-tenant cluster deployments, as it allows unauthorized access to critical infrastructure components regardless of normal security boundaries. The vulnerability affects all downstream clusters managed by the Fleet controller.
DailyCVE Form:
Platform: Rancher Fleet
Version: <0.12.15, <0.13.11, <0.14.6, <0.15.2
Vulnerability: Multi-Tenant Isolation Bypass
Severity: Critical (CVSS 9.9)
date: May 13, 2026
Prediction: July 2026
What Undercode Say:
Analytics on this CVE reveal the following key commands and code patterns associated with the exploitation and remediation of this vulnerability.
Exploit Pattern (valuesFrom in fleet.yaml):
Malicious fleet.yaml in a GitRepo monitored by Fleet namespace: tenant-namespace helm: releaseName: malicious-release valuesFrom: - secretKeyRef: name: target-secret namespace: target-namespace key: sensitive-key
Exploit Pattern (HelmOp without ServiceAccount restriction):
apiVersion: fleet.cattle.io/v1alpha1 kind: HelmOp metadata: name: malicious-helmop namespace: tenant-namespace spec: helm: releaseName: privileged-release chart: ./chart No serviceAccount specified, allowing the Fleet agent's default (over-privileged) service account to be used.
Patch Verification (Policy Resource):
apiVersion: fleet.cattle.io/v1alpha1 kind: Policy metadata: name: tenant-restriction namespace: tenant-namespace spec: serviceAccount: restricted-sa Enforce a specific, least-privilege SA helmRepoURLRegex: "^https://charts.my-company.com/.$" Restrict Helm repo URLs
Exploit:
An attacker with push access to a Fleet-monitored Git repository can exploit this vulnerability by:
1. Crafting a Malicious fleet.yaml: The attacker adds a `valuesFrom` section to the `fleet.yaml` file within the repository. This section uses a `secretKeyRef` to point to a secret in any namespace on the downstream cluster.
2. Pushing the Change: The attacker pushes the malicious `fleet.yaml` to the Git repository.
3. Fleet Agent Execution: The Fleet controller detects the change and the Fleet agent on the downstream cluster processes the GitRepo.
4. Privilege Escalation: Due to the flawed ServiceAccount impersonation, the Fleet agent performs the `valuesFrom` lookup using its own (over-privileged) service account or one with insufficient restrictions, rather than the tenant’s restricted service account.
5. Secret Exfiltration: The contents of the targeted secret are read and can be used to deploy a `HelmOp` or `Bundle` with cluster-wide scope, effectively granting the tenant cluster-admin privileges.
Protection:
The primary protection against CVE-2026-41050 is to upgrade to a patched version of Fleet: v0.15.2, v0.14.6, v0.13.11, or v0.12.15. These versions introduce a new Policy resource that allows administrators to:
Enforce ServiceAccount Usage: Configure GitRepos, HelmOps, and `Bundles` to require a specific service account for the Fleet agent on downstream clusters. The agent uses these designated service accounts for operations, blocking access to unauthorized resources.
Restrict Helm Repository URLs: Restrict `HelmOp` repository and chart URLs by using a regular expression. The regular expression is automatically anchored with `^` and $, meaning it must match the entire URL string.
Important: Before applying a policy, ensure that the required service account is available on the downstream clusters and is configured with least-privilege permissions.
If an immediate upgrade is not possible, implement these workarounds:
Disable Fleet-monitored repositories for untrusted tenants.
Audit Git repositories for malicious activity, specifically looking for unauthorized `valuesFrom` references or `HelmOp` definitions.
Deploy NeuVector as a primary workaround. Configure an admission control Deny rule for “Run as privileged” in Protect mode. NeuVector evaluates pod specs independently of Kubernetes PSS namespace labels and blocks privileged containers even if the labels are downgraded.
Impact
The impact of this vulnerability is severe, especially in multi-tenant environments where different tenants share the same downstream clusters. An attacker can:
Access Sensitive Data: Read the contents of any config map or secret across all namespaces on the downstream cluster.
Escalate Privileges: Gain full cluster-admin status, allowing them to create, modify, or delete any resource in the cluster.
Bypass Tenant Isolation: Completely break the multi-tenant isolation model, allowing one tenant to access and potentially compromise the resources of other tenants.
Harvest Credentials: Expose sensitive credentials, API keys, and configuration data, which can lead to further compromise of external services.
This vulnerability aligns with CWE-284 (Improper Access Control) and maps to MITRE ATT&CK techniques related to privilege escalation and credential access.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
