Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/rancher/fleet | go | >= 0.15.0, < 0.15.2 | 0.15.2 |
| github.com/rancher/fleet | go | >= 0.14.0, < 0.14.6 | 0.14.6 |
| github.com/rancher/fleet | go | >= 0.13.0, < 0.13.11 | 0.13.11 |
| github.com/rancher/fleet | go | >= 0.12.0, < 0.12.15 | 0.12.15 |
Miggo AIRoot Cause AnalysisThe vulnerability exists in the webhook handler of Rancher Fleet, specifically in the ServeHTTP function within pkg/webhook/webhook.go. This function is designed to process webhook notifications, for example from a Git provider, to trigger updates for GitRepo resources.
The root cause of the vulnerability is a regular expression injection. The ServeHTTP function dynamically constructs a regular expression to match an incoming webhook to a configured GitRepo. It uses the repository URL from the webhook payload to build this regex. However, it failed to sanitize the hostname and path components of the URL before incorporating them into the regex string.
An attacker could exploit this by sending a webhook payload where the repository URL contains regex metacharacters. For instance, a hostname of .* would cause the server to build a regex that matches any GitRepo, regardless of its actual repository URL. This allows an unauthenticated attacker to trigger actions on arbitrary GitRepo resources, leading to denial of service through continuous re-cloning or unauthorized downgrades of services.
The patch, identified in commit 810c4f9405b2a1450f02ec9a51c8947b71c5d10b, resolves this issue by using regexp.QuoteMeta on the hostname and path components of the URL. This function escapes any special regex characters, ensuring that the URL from the webhook is treated as a literal string, not a pattern. This prevents the injection and ensures that webhooks can only match the GitRepo resources they are intended for.
webhook.Webhook.ServeHTTPpkg/webhook/webhook.go