Suse
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in any Suse product.
RSS Feeds for Suse security vulnerabilities
Create a CVE RSS feed including security vulnerabilities found in Suse products with stack.watch. Just hit watch, then grab your custom RSS feed url.
Products by Suse Sorted by Most Security Vulnerabilities since 2018
By the Year
In 2026 there have been 75 vulnerabilities in Suse with an average score of 7.4 out of ten. Last year, in 2025 Suse had 29 security vulnerabilities published. That is, 46 more vulnerabilities have already been reported in 2026 as compared to last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 0.09.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 75 | 7.38 |
| 2025 | 29 | 7.29 |
| 2024 | 8 | 7.00 |
| 2023 | 20 | 7.84 |
| 2022 | 21 | 7.10 |
| 2021 | 12 | 6.19 |
| 2020 | 39 | 6.41 |
| 2019 | 13 | 7.09 |
| 2018 | 39 | 7.37 |
It may take a day or so for new Suse vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Suse Security Vulnerabilities
| CVE | Date | Vulnerability | Products |
|---|---|---|---|
| CVE-2026-116472 | Nov 05, 2026 |
Ingress-NGINX DoS & traffic redirect via mirror-target annotationA security issue was discovered in ingress-nginx where a user with permission to create an Ingress may be able to cause denial of service of the ingress-nginx data plane, or possibly redirect traffic from other Ingresses. Kubernetes clusters are only affected if they are using ingress-nginx. Due to a missing check, the mirror-target Ingress annotation can be used to target an unauthenticated configuration API within the ingress-nginx controller, allowing write commands to be submitted. Corrupting the data within that configuration API results in all traffic through ingress-nginx being dropped until an Ingress configuration change or a controller restart causes the data to be recreated correctly. In principle, this write access could also be used to redirect traffic from other Ingresses controlled by the same ingress-nginx instance. In practice, there is negligible additional risk: such redirection would require privileged information about internal ingress-nginx state, and users can already redirect traffic from other Ingresses controlled by the same ingress-nginx anyway. |
Rancher
|
| CVE-2026-88811 | Nov 02, 2026 |
SUSE Rancher 2.15.x Meta Proxy Credential Leak (CVE-2026-88811)Missing filtering in the SUSE Rancher Manager meta proxy could cause passed in rancher credentials to be leaked to cloud providers. This affects SUSE Rancher 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, 2.13.0 up to 2.13.11, |
Rancher
|
| CVE-2026-88810 | Nov 02, 2026 |
Privilege Escalation in SUSE Rancher Manager 2.15.2 via inheritedNamespacedRulesA privilege escalation issue was discovered in Rancher Manager's role-based access control. The inheritedNamespacedRules field of a GlobalRole propagates permissions into named namespaces of every downstream cluster managed by the Rancher instance, but it was not subject to the privilege-escalation validation applied to the other permission-carrying fields of a GlobalRole. As a result, a non-administrative user could be granted, through a global role binding, permissions in downstream clusters that exceed the permissions that user already holds. This affected SUSE Rancher 2.15.2 only, and SUSE Rancher Webhook 0.11.0 up to 0.11.4, and 0.12.0 up to 0.12.1. |
Rancher
|
| CVE-2026-88809 | Nov 02, 2026 |
SUSE Rancher Manager 2.15.3 Meta Proxy Allowlist BypassA security vulnerability exists in the SUSE Rancher Manager meta proxy endpoint (/meta/proxy). This endpoint is intended to forward requests only to destinations that appear on a configured allowlist. The allowlist decision was evaluated in a place where it could not stop a request from being forwarded, so a rejected destination was logged but the request was still handed to the proxy's transport. This affects SUSE Rancher 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, 2.13.0 up to 2.13.11, 2.12.0 up to 2.12.15, 2.11.0 up to 2.11.19 and potentially older EOL versions. |
Rancher
|
| CVE-2026-94290 | Nov 02, 2026 |
SUSE Rancher Fleet Priv Escalation via Unrestricted Kubeconfig RefSUSE Rancher Fleet clusters reference a kubeconfig secret that the controller uses to install and manage a Fleet agent on the target cluster. The controller did not sufficiently restrict which kubeconfig secrets a Fleet Cluster object was allowed to reference. As a result, a Fleet cluster defined in a namespace an ordinary user controls could be associated with administrative credentials for the management cluster itself, causing the controller to manage the management cluster on that user's behalf and to run that user's Fleet content there with elevated privileges. This affects SUSE Rancher Fleet 0.16.0 up to 0.16.3, 0.15.0 up to 0.15.8, 0.14.0 up to 0.14.12, 0.13.0 up to 0.13.17 and possible older versions. |
Rancher
|
| CVE-2026-104623 | Oct 30, 2026 |
SUSE Rancher Manager <2.15.4 AuthZ Bypass in Management Cluster ShellA security vulnerability exists in the authorization handling for the local (management) cluster shell feature of SUSE Rancher Manager 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, 2.13.0 up to 2.13.11, 2.12.0 up to 2.12.15, 2.11.0 up to 2.11.19 and possible older versions. The authorization check that was introduced to protect this feature was not applied to every API route that can reach it, so an alternative request form reached the shell handler without the access check being evaluated. This could allow any authenticated users to run a pod on the management cluster. |
Rancher
|
| CVE-2026-104615 | Oct 30, 2026 |
SUSE Rancher Fleet <0.12 or 0.130.16.3: Tokenbinding bypassA security vulnerability was discovered in SUSE Rancher Fleet's cluster registration flow, in Fleet versions before 0.12, 0.13.0 up to 0.13.17, 0.14.0 up to 0.14.12, 0.15.0 up t o 0.15.17 and 0.16.0 up to 0.16.3. The cluster identity claimed by a registration request was accepted without being bound to the registration token that the request was made with. As a result, a registration request could be associated with a managed cluster that was originally registered with a different registration token. |
Rancher
|
| CVE-2026-104618 | Oct 15, 2026 |
Info Disclosure: SUSE sdbootutil Creates World-Readable LogOn request the `sdbootutil` script creates a world-readable debug log in /var/log/sdbootutil.log. The log file is created world-readable, however, which means that arbitrary low-privileged users in the system will be able to extract secrets from it. |
Linux Enterprise Server
|
| CVE-2026-104617 | Oct 15, 2026 |
qrencode Private Data Leak via /proc (lowpriv)There are two invocations of `qrencode` to display a QR code for scanning. These invocations leak the private data $pin / $key via /proc accessible for arbitrary low-privileged users in the system. |
Linux Enterprise Server
|
| CVE-2023-32198 | Oct 15, 2026 |
TLS Cert Validation Bypass in Steve (MitM Vulnerability)A vulnerability has been identified in Steve where by default it was using an insecure option that did not validate the certificate presented by the remote server while performing a TLS connection. This could allow the execution of a man-in-the-middle (MitM) attack against services using Steve. |
|
| CVE-2024-22031 | Oct 15, 2026 |
Privilege Escalation via Duplicate Project Names in RancherA vulnerability has been identified within Rancher where a user with the ability to create a project, on a certain cluster, can create a project with the same name as an existing project in a different cluster. This results in the user gaining access to the other project in the different cluster, resulting in a privilege escalation. This happens because the namespace used on the local cluster to store related resources (PRTBs and secrets) is the name of the project. |
Rancher
|
| CVE-2025-23390 | Oct 15, 2026 |
SUSE Fleet SSH Auto-Trust Vulnerability Enables MitM AttackA vulnerability has been identified within Fleet where, by default, Fleet will automatically trust a remote servers certificate when connecting through SSH if the certificate isnt set in the `known_hosts` file. This could allow the execution of a man-in-the-middle (MitM) attack against Fleet. In case the server that is being connected to has a trusted entry in the known_hosts file, then Fleet will correctly check the authenticity of the presented certificate. |
|
| CVE-2026-88804 | Sep 28, 2026 |
Rancher UI XSS via Unauth Update of Public Settings (2.15.1)An unauthenticated update of public UI settings could be used by remote attackers to execute a stored cross-site scripting attack in the Rancher UI, in SUSE Rancher 2.15 before 2.15.2, 2.14 before 2.14.6, 2.13 before 2.13.10, 2.12 before 2.12.14 and 2.11 before 2.11.18. |
Rancher
|
| CVE-2026-88805 | Sep 28, 2026 |
SUSE Rancher 2.15 Remote Credential Retention on LogoutIncorrect credential cleaning on logout could be used by remote attackers to keep access credentials even after the account was logged out. Affected is SUSE Rancher 2.15 before 2.15.2. |
Rancher
|
| CVE-2026-88808 | Sep 28, 2026 |
SUSE Rancher Fleet 0.16 before 0.16.2: Agent Overwrites Config in Shared ClustersA vulnerability has been identified within Rancher Manager where the Fleet agent wrote resources to downstream clusters using its own cluster-admin credentials instead of the ServiceAccount pinned to the deployment. It affects multi-tenancy environments where different tenants share the same downstream clusters, for example different privileged or untrusted teams inside the same organization. This could lead to overwritten configuration files. This issue affected SUSE Rancher Fleet 0.16 before 0.16.2, 0.15 before 0.15.7, and 0.14 before 0.14.11. |
Rancher
|
| CVE-2026-93540 | Sep 28, 2026 |
SUSE Rancher Fleet Privilege Mismatch: Namespace Update Escalation (pre 0.16.2)A privilege mismatch was found in Fleet. When a bundle requested namespace labels or annotations through the namespaceLabels and namespaceAnnotations options, the resulting namespace metadata update was not subject to the same authorization as the rest of the bundle's deployment. As a result, a bundle could change labels and annotations on a target namespace even when the identity it was pinned to was not authorized to modify that namespace. This affected SUSE Rancher Fleet 0.16 before 0.16.2, 0.15 before 0.15.7, 0.14 before 0.14.11, 0.13 before 0.13.16 and potentially older versions. |
Rancher
|
| CVE-2026-93539 | Sep 28, 2026 |
SUSE Rancher Fleet 0.16 Unverified Secret Unauthorized Repo PollingInt ChangeA vulnerability was discovered in Fleet's Git webhook receiver (the gitjob webhook service). When a webhook secret is not configured, incoming webhook requests are accepted without verification, and processing a request can change the spec.pollingInterval field of a matching GitRepo resource in any namespace. A caller with network access to the webhook service and no Kubernetes credentials can therefore alter GitRepo configuration outside the namespaces they are authorized for. This only affects SUSE Rancher Fleet 0.16 before 0.16.2, older versions are not affected. |
Rancher
|
| CVE-2026-93538 | Sep 28, 2026 |
SUSE Rancher Fleet <0.16.1 Cross-tenant Auth Bypass via Agent-Set Cluster LabelsA cross-tenant authorization issue was discovered in SUSE Rancher Fleet. During agent-initiated cluster registration, cluster labels supplied by the registering agent, including labels in the reserved management.cattle.io/ namespace such as the cluster display name label, were applied to the resulting upstream Cluster object. Because Fleet resolves GitRepo and Bundle targets from those cluster labels, a party able to register a cluster into a Fleet workspace namespace shared with other tenants could cause its own cluster to satisfy targeting rules that administrators intended for a different cluster. This affects SUSE Rancher Fleet 0.16 before 0.16.1, 0.15 before 0.15.6, 0.14 before 0.14.10, 0.13 before 0.13.15, 0.12 before 0.12.19 and older versions. |
Rancher
|
| CVE-2026-93537 | Sep 28, 2026 |
SUSE Rancher Fleet 0.16.x - LFI via GitRepo bundle content (before 0.16.2)A user who can supply bundle content to a repository referenced by a GitRepo resource, for example through Git push access, or through permission to create or modify a GitRepo, can cause SUSE Rancher Fleet to read files from the filesystem of the environment that processes the bundle and include their contents in the generated Bundle resource. This can expose configuration or credential material that the user has no Kubernetes RBAC permission to read, including Helm registry credentials made available to the bundle-processing job when per-path Helm credentials are configured. This affects Fleet 0.16 before 0.16.2, 0.15 before 0.15.7, 0.14 before 0.14.11, 0.13 before 0.13.16, 0.12 before 0.12.20 and potentially older unsupported versions. |
Rancher
|
| CVE-2026-78424 | Sep 28, 2026 |
NeuVector 5.4-5.6 Improper Parameter Handling Enables OS Command InjectionImproper parameter handling in NeuVector allows any authenticated user who holds the namespaced Runtime Policies (write) permission or anyone with access to NeuVectors internal gRPC certificate key pair the ability to inject OS commands in the privileged enforcer container, which can lead to the complete compromise of the worker node. This affects NeuVector 5.4 before 5.4.11, NeuVector 5.5 before 5.5.4, NeuVector 5.6 before 5.6.2 and potentially older versions. |
Neuvector
|
| CVE-2026-78427 | Sep 17, 2026 |
NeuVector admission webhook bypass via sidecar image exclusion (v<5.6.2)The NeuVector admission webhook silently excludes containers from policy evaluation when their image path matches one of three hardcoded service mesh sidecar images. Since the image path is entirely controlled by the workload author, any user capable of deploying workloads can evade admission deny rules simply by naming their image path after one of these sidecar images. |
Neuvector
Github Com Neuvector Neuvector
|
| CVE-2026-78425 | Sep 17, 2026 |
NeuVector 5.6.1 SAML SSO Assertion Auth Bypass via IdPAuthorised users of outside applications behind the same corporate identity provider (IdP), for example, a wiki, a ticketing system, an expenses tool, or anything they legitimately hold an account on can log into their system via SAML SSO. The IdP issues an assertion to them. If that assertion is presented to NeuVector, NeuVector accepts it because the only thing distinguishing "an assertion for NeuVector" from "an assertion for the wiki" is the element, and the `NotInAudience` warning that reports the mismatch is never read. |
Neuvector
Github Com Neuvector Neuvector
|
| CVE-2026-78426 | Sep 17, 2026 |
NeuVector JWT verifier accepts noncanonical Base64URL signatures (v5.6.1)The NeuVector JWT verifier accepts noncanonical Base64URL encodings of the same RSA signature field. An attacker holding a valid JWT that has not expired, but was logged out of NeuVector, can continue using the non-expired token with equivalent spelling of the RSA signature field until the token validity expires. |
Neuvector
|
| CVE-2026-78428 | Sep 17, 2026 |
Neuvector SSO Session Mixup in SAML/OIDC (<5.6.1) Auth HijackingFor users authenticated through SAML or OpenID Connect (OIDC), this vulnerability can result in one user receiving another user's authenticated session when multiple SSO login attempts occur concurrently |
Neuvector
|
| CVE-2026-44940 | Sep 17, 2026 |
SUSE Observability rancher-extension-stackstate Exposes Service TokensThe rancher-extension-stackstate extension in SUSE Observability exposes service tokens in plain configuration or insecure locations rather than managing them securely. An attacker with minimal access could obtain the token to gain unauthorized access or escalate privileges within the observability environment. |
|
| CVE-2026-44950 | Sep 10, 2026 |
Heap buffer overflow in libXfont2 fs_read_glyphs()fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) copies each glyph's bitmap into a single buffer. Existing checks validates only that the source slice (position, length) lies within the source bitmap buffer. It does not check whether the running destination cursor has exceeded the allocation. A malicious font server can send overlapping source offsets -- for example 1000 glyphs each referencing {position:0, length:64} with nbytes=64. Each individual source range passes the existing validation, but the cumulative writes total 64000 bytes into a 64-byte destination buffer. This is a heap buffer overflow with attacker-controlled content. |
Linux Enterprise Desktop
Linux Enterprise
Linux Enterprise Server
And others... |
| CVE-2026-59679 | Sep 10, 2026 |
OOB Heap Read in libXfont2 query glyphs (CVE-2026-59679)fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) indexes the per-character encoding[] array using num_chars from the FS_QueryXBitmaps16 reply, but that array was allocated with a size derived from num_extents in the separate FS_QueryXExtents16 reply. The two CARD32 fields are never cross-checked. A malicious or compromised font server can send a small num_extents (e.g. 1) in the extents reply, then a large num_chars (e.g. 100000) in the bitmaps reply. This causes attacker-controlled out-of-bounds heap read and writes. |
Linux Enterprise Desktop
Linux Enterprise
Linux Enterprise Server
And others... |
| CVE-2025-46808 | Sep 09, 2026 |
Sensitive Info Logging in SUSE Neuvector Manager (<5.4.5)An Insertion of Sensitive Information into Log File vulnerability in SUSE neuvector manager exposes sensitive information into the manager containers log This issue affects neuvector: before 5.4.5. |
Neuvector
|
| CVE-2026-75036 | Sep 03, 2026 |
Fleet Helm Templating (0.12-0.16) Clusters Metadata DisclosureA security vulnerability was discovered in Fleet's Helm template preprocessing where templates evaluated by the Fleet controller could reach network resources outside the management cluster. A user who can supply bundle content to a repository referenced by a `GitRepo` resource can cause the Fleet controller to: - Disclose cluster metadata available to the templating context. - Reveal information about hosts reachable from the controller's network position. Because the disclosure channel is name resolution, it may remain effective in environments where outbound traffic is otherwise restricted. The disclosed information is limited to values exposed to the Fleet templating context and to name resolution results. Integrity and availability of managed clusters are not affected. This issue affects Fleet: from 0.12.0 before 0.12.19, from 0.13.0 before 0.13.15, from 0.14.0 before 0.14.10, from 0.15.0 before 0.15.6, and from 0.16.0 before 0.16.1. |
|
| CVE-2026-75035 | Sep 03, 2026 |
Rancher Manager 2.15.1 - Token Store Owner Filter Bypass (CVE-2026-75035)A flaw was found in Rancher Manager. When a non-administrative caller supplied a label selector naming a different user, the ext.cattle.io/v1 Token store dropped its internal owner filter instead of returning an empty result. Any authenticated user could therefore list and watch every other user's tokens, disclosing token metadata and the stored salted hash of the bearer token. This issue affects Rancher: before 2.15.1. |
Rancher
|
| CVE-2026-75034 | Sep 03, 2026 |
Rancher Manager 2.15.1 SAML Assertion Replay in HA Replicas (CVE-2026-75034)A flaw was found in Rancher Manager. The SAML assertion replay protection introduced by the fix for CVE-2026-44946 recorded consumed assertion IDs in a per-process cache, so each replica only detected replays that reached the same pod. In a high-availability deployment, an attacker holding a captured assertion could replay it once against every other replica to obtain additional authenticated sessions as the victim. This issue affects Rancher: before 2.15.1. |
Rancher
|
| CVE-2026-75033 | Sep 03, 2026 |
Rancher Manager <2.15.1: Project Secrets Leak via Namespace Annotation SpoofA flaw was found in Rancher Manager. Project Secrets were propagated into a namespace based only on its `field.cattle.io/projectId` annotation, without verifying that the referenced project belonged to the same downstream cluster. A user able to create namespaces on one cluster could set the annotation to a project ID from another cluster and have that project's secrets copied into a namespace under their control. This issue affects Rancher: before 2.15.1. |
Rancher
|
| CVE-2026-71404 | Sep 03, 2026 |
Privilege Escalation in Rancher Manager <2.15.1 via GlobalRole ControllerA flaw was found in Rancher Manager. The GlobalRole controller derived the target ClusterRole name from the user-settable `authz.management.cattle.io/cr-name` annotation and overwrote that object's rules without verifying ownership. A user with delegated GlobalRole create or update permission could point the annotation at any existing ClusterRole, such as `cluster-admin`, and revoke the permissions of every principal bound to it. The change persists after the malicious GlobalRole is deleted. This issue affects Rancher: before 2.15.1. |
Rancher
|
| CVE-2026-71403 | Sep 03, 2026 |
Rancher Manager <2.15.1: '/v3/users' Immutable Username/PrincipalIds BypassA flaw was found in Rancher Manager. The /v3/users update path did not enforce immutability of a User resource's `username` and `principalIds` fields. A user holding the `update` verb on `users.management.cattle.io` could inject a foreign identity provider principal into any account, so that the next login by the owner of that principal was bound to the victim's account and inherited its role bindings. This issue affects Rancher: before 2.15.1. |
Rancher
|
| CVE-2026-25706 | Sep 01, 2026 |
SUSE yast2-samba-client <=5.0.4: OS Cmd Injection via AD contentImproper neutralization of special elements used in an OS command in yast2-samba-client allows an attacker who controls the content of an Active Directory directory tree - a rogue domain controller, or a directory user delegated the right to create objects - to execute arbitrary commands as root on a machine being joined to that domain. This issue affects yast2-samba-client through 5.0.4. |
|
| CVE-2026-59681 | Sep 01, 2026 |
OS Command Injection in yast2-auth-client via Unvalidated AD ConfigA OS command injection vulnerability in yast2-auth-client allows an attacker who controls Active Directory configuration values to execute arbitrary commands as root on the configured host. Auth::AuthConf in src/lib/auth/authconf.rb assembles the Samba net ads join, net ads lookup -S and net ads testjoin invocations by interpolating configuration values into a single command string and passing that string to Open3.popen2 / Open3.capture2, which causes Ruby to run it through /bin/sh. The Organizational Unit (ou), dnshostname, AD user name and AD domain name values are neither validated nor shell-quoted. |
|
| CVE-2026-59680 | Sep 01, 2026 |
OS Command Injection in yast2-users <=5.0.8 via Password Settings TabAn OS command injection vulnerability was found in yast2-users. When displaying the "Password Settings" tab of a user, get_password_term() in src/include/users/dialogs.rb read the shadowLastChange and shadowExpire fields with GetString(), which performs no numeric validation, and passed the resulting string to format_days_after_epoch(). That helper interpolated the value into a shell command executed via Ruby backticks without quoting or escaping. Impact: an administrator who manages users against an external/federated LDAP directory via `yast2 users` triggers root command execution the moment they view or edit that particular user's "Password Settings" tab. No "join domain" or trust setup is required, just browsing/editing one user entry. This issue affects yast2-users through 5.0.8. |
|
| CVE-2026-71402 | Aug 27, 2026 |
wicked OOB Read in DHCPv4 Packet Capture (0.6.80)An out-of-bounds read was found in the DHCPv4 packet capture code of wicked. ni_capture_inspect_udp_header() in src/capture.c reports the IP total length as the payload length instead of the length of the remaining UDP payload. Consequently, the DHCP option walker in the DHCPv4 client (wickedd-dhcp4) reads up to ihl + 8 bytes at most 68 bytes past the end of the 1500-byte packet receive buffer. An unauthenticated attacker on the same network who sends a crafted DHCP/UDP packet can make the client parse adjacent heap memory as DHCP options, so that heap contents such as allocator metadata or pointer values can be interpreted into lease fields. The over-read is bounded to 68 bytes; no memory write, no attacker control over the adjacent bytes and no remote exfiltration primitive has been demonstrated. This issue affects wicked up to and including version 0.6.80. |
|
| CVE-2026-71401 | Aug 27, 2026 |
Integer Underflow in wicked DHCPv4 Client (0.6.80) Out-of-Bounds ReadAn integer underflow was found in the DHCPv4 packet capture code of wicked. ni_capture_inspect_udp_header() in src/capture.c does not verify that the IP total length field (ip_len) is at least as large as the IP header length (ihl) before subtracting the header length. An unauthenticated attacker on the same network can thereby trigger an out-of-bounds read past the receive buffer in the wicked DHCPv4 client (wickedd-dhcp4), which can crash the daemon depending on the process memory layout. No information disclosure has been demonstrated. This issue affects wicked up to and including version 0.6.80. |
|
| CVE-2026-44945 | Aug 05, 2026 |
Rancher PrivEsc via Impersonate Middleware (Pre-2.14.2)A privilege escalation vulnerability exists in Rancher's impersonation middleware (pkg/auth/requests/impersonate.go). An authenticated Rancher user with the default user global role can gain full administrative access to the Rancher control plane and transitively to all downstream clusters it manages. This issue affects Rancher: from 2.11.0 before 2.11.16, from 2.12.0 before 2.12.12, from 2.13.0 before 2.13.8, and from 2.14.0 before 2.14.2. |
Rancher
|
| CVE-2026-25703 | Aug 05, 2026 |
NeuVector 5.4.9 Auth Bypass & Data Leak via /network/graph APINeuVector through 5.4.9 is can potentially leak information from manager /network/graph API due to missing authentication and cached data containing sensitive information. |
Neuvector
|
| CVE-2026-55998 | Aug 05, 2026 |
SUSE Manager: Null Pointer, Enumeration in Systemtemplate PrivateRegistryThe endpoint /v3/import/{token}_{clusterId}.yaml retrieves the cluster object before validating the token. When a valid cluster ID references a cluster that has private registry secrets configured, a nil pointer dereference in pkg/systemtemplate/private_registry.go causes the request to return HTTP 502 Bad Gateway. For cluster IDs that do not exist, the endpoint returns HTTP 200. This observable difference in response codes constitutes a reliable enumeration oracle. |
Rancher
|
| CVE-2026-59675 | Aug 05, 2026 |
Rancher Manager API Body Size Bypass Leads to DoS via Audit LoggingWhen API audit logging is enabled, the middleware reads the entire HTTP request body into memory without enforcing a size limit on login endpoints. Because the audit middleware is positioned earlier in the handler chain than Rancher's APIBodyLimitingHandler, the body-size cap (default 1 MiB) is bypassed for requests that pass through the audit copyReqBody path. An unauthenticated attacker can send arbitrarily large request bodies to the public login endpoints, causing the Rancher Manager server process to allocate memory proportional to the supplied body size. With just a few concurrent connections, this can exhaust available memory and terminate the Rancher Manager plane process, making the Rancher API and UI unavailable and interrupting management of all downstream clusters. |
Rancher
|
| CVE-2026-55996 | Aug 05, 2026 |
DoS via unbounded SAN growth in Rancher TLS listenersA denial-of-service vulnerability was identified in multiple TLS listeners in Rancher. Both the cattle-cluster-agent component running in downstream clusters and the Rancher server itself use the dynamiclistener library to serve TLS traffic. Without an effective CN filter configured, dynamiclistener automatically appended to each serving certificate any hostname presented via Server Name Indication (SNI) in incoming TLS requests. An unauthenticated attacker with network access within the affected cluster could send a large number of TLS requests with distinct hostnames, causing the serving certificate to accumulate an unbounded number of Subject Alternative Names (SANs). Eventually, the certificate grows large enough that TLS handshakes fail with an excessive message size error, causing a denial of service on the affected listeners. |
Rancher
|
| CVE-2025-8412 | Jul 14, 2026 |
SUSE VM Driver Pack Buffer Overflow via RegistryA Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in SUSE Virtual Machine Driver Pack allows an attacker with the ability to modify the registry to affect the integrity of the driver. We're not aware of a feasible way to exploit this currently. This issue affects Virtual Machine Driver Pack: before e7a602ec232756ead019bdf19d6d3b9d010cc94b. |
|
| CVE-2026-59674 | Jul 14, 2026 |
openSUSE Suricata <8.0.5-2.1: Symlink Escalation to RootA UNIX Symbolic Link (Symlink) Following vulnerability in openSUSE Tumbleweed suricata package allows the suricata user to escalate to root. This issue affects openSUSE Tumbleweed: from ? before 8.0.5-2.1; openSUSE Tumbleweed: from ? before 8.0.5-2.1. |
|
| CVE-2026-44938 | Jul 07, 2026 |
CVE-2026-44938: Fleet Agent Deployer NamespaceLabel InjectionA vulnerability has been identified in Fleet's agent-side deployer, which did not filter security-sensitive keys from namespaceLabels in fleet.yaml (or BundleDeployment.spec.options.namespaceLabels) when applying them to the target namespace. An attacker with git push access to a Fleet-monitored repository could overwrite Pod Security Standards (PSS) enforcement labels on a target namespace. This allows the attacker to weaken admission controls and deploy workloads that PSS policies would otherwise block. |
Rancher
|
| CVE-2026-44937 | Jul 06, 2026 |
SUSE Rancher Fleet <=0.15.1 Webhook request forgery leading to DoSPotential forgery of webhook requests when using a unauthenticated webhook in SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.5 could be used by remote attackers to cause a denial of service or a downgrade attack on other repositories on the system. |
Rancher
|
| CVE-2026-44936 | Jul 06, 2026 |
Missing helmRepoURLRegex filter on SUSE Rancher Fleet 0.15 leaks BasicAuthMissing filtering when the helmRepoURLRegex field isn't set on a GitRepo resource in SUSE Rancher Fleet's bundle reader in 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.15 forwards Helm authentication credentials (BasicAuth) to any URL specified in the helm.repo field of a fleet.yaml file, allowing attackers able to push to fleet monitored git repos to leak helm access credentials. |
Rancher
|
| CVE-2026-44934 | Jul 06, 2026 |
SUSE Rancher AI Agent 1.0 Before 1.0.2: DEBUG Log Disclosure of API KeysA information disclosure when DEBUG loglevel is set in SUSE Rancher AI Agent 1.0 before 1.0.2 could leak API keys or LLM response text with potential sensitive data into logfiles, allowing local attackers to misuse respective gained data or credentials. |
Rancher
|