CVE-2026-44948 Details

A path traversal vulnerability has been identified in the ImageScan subsystem of Rancher Fleet versions 0.12.0 prior to 0.12.16, 0.13.0 prior to 0.13.12, 0.14.0 prior to 0.14.7, and 0.15.0 prior to 0.15.3. This vulnerability allows an authenticated user with permission to create or modify GitRepo resources to traverse outside the intended directory. The exploitation of this vulnerability causes resource exhaustion, leading to a denial-of-service condition in the ImageScan subsystem.

Users can upgrade to Rancher Fleet versions 0.12.16, 0.13.12, 0.14.7, or 0.15.3, where this vulnerability has been patched. For Fleet v0.15, the ImageScan feature can be disabled by setting 'imagescan.enabled=false' in the Helm chart values. Additionally, users can restrict the creation or modification of GitRepo resources through Kubernetes RBAC to prevent untrusted users from exploiting this vulnerability.