{"action":"Upgrade github.com/rancher/fleet to 0.12.15 or later.","affected":[{"fixed":"0.15.2","introduced":"0.15.0"},{"fixed":"0.14.6","introduced":"0.14.0"},{"fixed":"0.13.11","introduced":"0.13.0"},{"fixed":"0.12.15","introduced":"0.12.0"}],"component":"github.com/rancher/fleet","cve_ids":["CVE-2026-44935"],"ecosystem":"Go","epss":0.0049,"exploited":false,"fixed_versions":["0.15.2","0.14.6","0.13.11","0.12.15"],"ghsa_id":"GHSA-xr65-5cpm-g36x","id":"tcs_01M5KFSN6QSQY5JAR8EBF6T8SF","modified_at":"2026-07-07T16:11:07.064124652Z","published_at":"2026-07-01T20:45:39Z","references":["https://osv.dev/vulnerability/GHSA-xr65-5cpm-g36x","https://github.com/rancher/fleet/security/advisories/GHSA-xr65-5cpm-g36x","https://github.com/rancher/fleet"],"severity":{"label":"critical","score":9.9},"sources":[{"source":"osv","source_id":"GHSA-xr65-5cpm-g36x","url":"https://osv.dev/vulnerability/GHSA-xr65-5cpm-g36x"}],"summary":"Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm Deployer"}