Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Missing filtering when the helmRepoURLRegex field isn't set on a GitRepo resource in SUSE Rancher Fleet's bundle reader in 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.15 forwards Helm authentication credentials (BasicAuth) to any URL specified in the helm.repo field of a fleet.yaml file, allowing attackers able to push to fleet monitored git repos to leak helm access credentials.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🟠 Fleet, Helm Credential Leakage via Unvalidated Repository URL, #CVE-2026-44936 (Medium) -DC-Jul2026-815 https://dailycve.com/fleet-helm-credential-leakage-via-unvalidated-repository-url-cve-2026-44936-medium-dc-jul2026-815/
Post summary
The text announces CVE‑2026‑44936, describing a Medium‑severity credential leakage via an unvalidated repository URL in Fleet’s Helm configuration. No exploit, PoC, or patch details are included.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | suse | rancher_fleet | - | - | - |