{"action":"Upgrade github.com/rancher/fleet to 0.12.15 or later.","affected":[{"fixed":"0.12.15","introduced":"0.12.0"},{"fixed":"0.13.11","introduced":"0.13.0"},{"fixed":"0.14.6","introduced":"0.14.0"},{"fixed":"0.15.2","introduced":"0.15.0"}],"component":"github.com/rancher/fleet","cve_ids":["CVE-2026-44935"],"ecosystem":"Go","epss":0.0049,"exploited":false,"fixed_versions":["0.12.15","0.13.11","0.14.6","0.15.2"],"ghsa_id":"GHSA-xr65-5cpm-g36x","id":"tcs_01M5KGQE450HWAEYY64X323N0F","modified_at":"2026-07-07T16:01:31.234390808Z","published_at":"2026-07-07T15:26:37Z","references":["https://osv.dev/vulnerability/GO-2026-5877","https://github.com/rancher/fleet/security/advisories/GHSA-xr65-5cpm-g36x"],"severity":{"label":"critical","score":9.9},"sources":[{"source":"osv","source_id":"GO-2026-5877","url":"https://osv.dev/vulnerability/GO-2026-5877"},{"source":"nvd","source_id":"CVE-2026-44935","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44935"}],"summary":"Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm Deployer in github.com/rancher/fleet"}