CVE-2026-44938 Details

A vulnerability exists in Fleet's agent-side deployer, specifically in versions 0.15.0 prior to 0.15.2, 0.14.0 prior to 0.14.6, 0.13.0 prior to 0.13.11, and 0.12.0 prior to 0.12.15. The issue arises because the deployer failed to properly filter security-sensitive keys from 'namespaceLabels' in 'fleet.yaml' or 'BundleDeployment.spec.options.namespaceLabels' when applying them to the target namespace. This oversight allows an attacker with git push access to a Fleet-monitored repository to overwrite Pod Security Standards (PSS) enforcement labels on a target namespace. As a result, the attacker can weaken admission controls and deploy workloads that PSS policies would typically block.

Users are advised to upgrade to Fleet versions 0.15.2, 0.14.6, 0.13.11, or 0.12.15, all of which include the necessary patch. If an immediate upgrade is not possible, consider deploying NeuVector as a primary workaround, which can block privileged containers even if PSS labels are downgraded. Alternatively, restrict repository access in multi-tenant setups to reduce the attack surface.