L3 · ShartedRancher · Fleet · Kubernetesrancher-fleet-october

Rancher and Fleet fixes cover management-cluster takeover and credential exposure

Four advisories cover Fleet cluster-admin escalation plus Rancher shell access, SSRF and credential forwarding. Ordinary authenticated users can reach some paths in default deployments. Upgrade Rancher and Fleet together; exposure is not proof of exploitation.

Disclosed: Oct 29, 2026; Public disclosure date
Severity: Sharted; 4 CVEs tracked here
Splash zone: Rancher accounts with the default user role and users of cloud provisioning forms; Rancher · Fleet · Kubernetes
In the wild: Unknown; The vendor advisories do not report active exploitation or a victim count.

What happened

Fleet is enabled by default. Its controller flaw needs an authenticated ordinary user, not an existing local-cluster role.

The shell flaw grants a management-network foothold, not cluster-admin by itself. SSRF requires a direct absolute-form HTTP/1.1 path; tested HTTP-aware proxies rewrite or reject it, but local pods may still reach the Service. Instance-metadata credential exposure depends on the environment, such as AWS IMDSv1.

Credential forwarding can happen during normal cloud-provisioning UI navigation without an attacker request. Patching stops future forwarding; it does not invalidate credentials already sent. No confirmed exploitation is established. L3 reflects mainstream control-plane and tenant-isolation impact.

What’s in the bowl

CVE-2026-94290

Fleet controller privilege escalation

A default-role user can cause the import controller to use management-cluster credentials, gaining cluster-admin and downstream secrets.

CVE-2026-104623

Local cluster shell authorization bypass

An authenticated user can start an unprivileged cattle-system shell pod; this alone adds no Kubernetes API permissions.

CVE-2026-88809

Meta proxy SSRF

Authenticated HTTP/1.1 absolute-form requests reaching Rancher without rewriting can bypass the destination allowlist.

CVE-2026-88811

Meta proxy credential forwarding

Ordinary provisioning lookups or API calls missing credential-selection headers can forward Rancher credentials to allowed third-party hosts.

Fixed versions

Product	Safe from	Note
Rancher 2.15	`2.15.3`
Rancher 2.14	`2.14.7`
Rancher 2.13	`2.13.11`
Rancher 2.12	`2.12.15`
Rancher 2.11	`2.11.19`	Rancher fixes only; check Fleet separately
Fleet 0.16	`0.16.3`
Fleet 0.14	`0.14.12`
Fleet 0.13	`0.13.17`
Fleet 0.15	`0.15.8`

Crime-scene timeline

Oct 29, 2026
Rancher publishes the cited management-plane advisories

Who said what

We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.

Fleet controller escalation advisoryPrimary
Rancher local shell advisoryPrimary
Rancher SSRF advisoryPrimary
Rancher credential-forwarding advisoryPrimary

Wipe guide

The wipe checklist

0 of 5 sheets used

Upgrade Rancher and bundled Fleet togetherCheck both installed versions against the table and upgrade compatible Rancher/Fleet versions together. The Fleet thresholds cover the controller escalation; the Rancher thresholds cover the three cited Rancher flaws. This table does not certify every advisory in the October release batch.
Check cross-namespace kubeconfig referencesAfter upgrade, manually managed cross-namespace secrets need fleet.cattle.io/kubeconfig-referenceable-from set to the Cluster namespace. Check Imported conditions. Do not leave allowUnlabeledKubeConfigSecretNamespaces enabled as a permanent workaround; deployed agents remain in place.
Invalidate potentially forwarded credentialsAfter patching, rotate or delete Rancher API tokens used through the meta proxy and invalidate user sessions. Audit whitelist-domain, drivers and ProxyEndpoint entries. API clients needing an upstream Authorization value must use X-API-Auth-Header.
Review management-plane access and evidenceInvestigate unexpected dashboard-shell-* pods in cattle-system, shell audit requests, local Fleet agents and cluster-admin ClusterRoleBindings. Remove unaccounted shell pods. A Failed to proxy log line is also produced for benign rejections and is not proof of forwarding or compromise. If SSRF is suspected, rotate reachable internal-service and cloud-metadata credentials.
Reduce exposure while arranging upgradesRestrict Fleet workspace creation and cluster/bundle writes to trusted operators. Require HTTP-aware ingress on every Rancher path, block direct pod-to-Service access except necessary components, and block unnecessary Rancher access to internal services and metadata. Limit shell endpoints to trusted administrative networks. These measures reduce exposure; they do not replace the patches.