tocsin

Go/github.com/rancher/fleet CVE-2026-44936: unknown, EPSS 0.35%

Rancher Fleet has SSRF in Bundle Reader via Unvalidated Helm Repository URL in fleet.yaml in github.com/rancher/fleet

Action: Upgrade github.com/rancher/fleet to 0.12.15 or later.

go get github.com/rancher/fleet@v0.12.15
go get github.com/rancher/fleet@v0.13.11
go get github.com/rancher/fleet@v0.14.6
go get github.com/rancher/fleet@v0.15.2

Affected

introducedfixedlast affected
0.12.00.12.15-
0.13.00.13.11-
0.14.00.14.6-
0.15.00.15.2-

Fixed versions

0.12.150.13.110.14.60.15.2

Sources

CVE-2026-44936 · published · modified · JSON