Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/rancher/fleet | go | >= 0.15.0, < 0.15.2 | 0.15.2 |
| github.com/rancher/fleet | go | >= 0.14.0, < 0.14.6 | 0.14.6 |
| github.com/rancher/fleet | go | >= 0.13.0, < 0.13.11 | 0.13.11 |
| github.com/rancher/fleet | go | >= 0.12.0, < 0.12.15 | 0.12.15 |
Miggo AIRoot Cause AnalysisThe vulnerability in Rancher Fleet (GHSA-xr65-5cpm-g36x) allowed for cross-namespace secret and configmap disclosure. This was due to the Helm deployer using the Fleet controller's own privileged Kubernetes client when processing valuesFrom references in GitRepo or HelmOp resources. An attacker could craft a resource that referenced a secret in any namespace, and the controller would fetch and expose its contents.
The root cause was traced to the internal/helmdeployer package. Specifically, the getValues function used the controller's client instead of a client scoped to the permissions of the service account specified for the deployment. The fix, identified in commit 190f2815a2f6bb208d7ffd3b7da1c9f942716cc0, involved a chain of modifications:
createCfg function was updated to accept a RESTClientGetter, allowing it to create Helm configurations with specific, non-privileged credentials.install function was changed to generate a correctly-scoped Kubernetes client based on the deployment's serviceAccount.getValues function was modified to use this passed-in, scoped client for all Kubernetes API calls, thereby enforcing RBAC policies correctly.A new Policy custom resource was introduced as a defense-in-depth measure, allowing administrators to define explicit restrictions on what resources can be accessed. However, the core vulnerability fix was the correct scoping of the client used for valuesFrom lookups.
Helm.getValuesinternal/helmdeployer/install.go
Helm.installinternal/helmdeployer/install.go
Helm.createCfginternal/helmdeployer/deployer.go