Rancher vulnerability

What happened

Fleet's Helm deployer did not fully apply ServiceAccount impersonation in two code paths, allowing a tenant with git push access to a Fleet-monitored repository to read secrets from any namespace on every downstream cluster targeted by their `GitRepo`.

Affected versions

Rancher: 0.15.0 through before 0.15.1 (semver); 0.14.0 through before 0.14.5 (semver); 0.13.0 through before 0.13.10 (semver); 0.12.0 through before 0.12.14 (semver); 0.11.0 through before 0.11.13 (semver) Fixed: See vendor advisory.

Why it matters

Review the vendor advisory and exposure of the affected product to determine operational impact.

Detection & mitigation

• Apply vendor-provided updates or mitigations.
• Review affected product exposure and access logs.