SUSE Rancher Fleet <0.12 or 0.130.16.3: Tokenbinding bypass
CVE-2026-104615 Published on October 30, 2026
Cluster identity takeover in Fleet cluster registration allows access to another cluster's Fleet namespace
A security vulnerability was discovered in SUSE Rancher Fleet's cluster registration flow, in Fleet versions before 0.12, 0.13.0 up to 0.13.17, 0.14.0 up to 0.14.12, 0.15.0 up t o 0.15.17 and 0.16.0 up to 0.16.3. The cluster identity claimed by a registration request was accepted without being bound to the registration token that the request was made with. As a result, a registration request could be associated with a managed cluster that was originally registered with a different registration token.
Vulnerability Analysis
CVE-2026-104615 can be exploited with network access, and requires user privileges. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity, and a high impact on availability.
Weakness Type
Authentication Bypass by Spoofing
This attack-focused weakness is caused by improperly implemented authentication schemes that are subject to spoofing attacks.
Products Associated with CVE-2026-104615
Want to know whenever a new CVE is published for Suse Rancher? stack.watch will email you.
Affected Versions
SUSE Rancher:- Version 0.16.0 and below 0.16.3 is affected.
- Version 0.15.0. and below 0.15.17 is affected.
- Version 0.14.0 and below 0.14.12 is affected.
- Version 0.13 and below 0.13.17 is affected.
- Before and including 0.12 is affected.