Cluster identity takeover in Fleet cluster registration allows access to another cluster's Fleet namespace
Impact
A security vulnerability was discovered in SUSE Rancher Fleet's cluster registration flow, in Fleet versions before 0.12, 0.13.0 up to 0.13.17, 0.14.0 up to 0.14.12, 0.15.0 up t o 0.15.17 and 0.16.0 up to 0.16.3. The cluster identity claimed by a registration request was accepted without being bound to the registration token that the request was made with. As a result, a registration request could be associated with a managed cluster that was originally registered with a different registration token.
Source excerpt · suseAffected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
SUSE · suse
Rancher
5 ranges
SUSE · suse
Rancher
Compare with this publisher’s ranges. This does not inspect your installation.
affected
0.16.0 → before 0.16.3
semver versions
0.15.0. → before 0.15.17
semver versions
0.14.0 → before 0.14.12
semver versions
0.13 → before 0.13.17
semver versions
0 → through 0.12
semver versions
Other versions: unaffected
Original source description
A security vulnerability was discovered in SUSE Rancher Fleet's cluster registration flow, in Fleet versions before 0.12, 0.13.0 up to 0.13.17, 0.14.0 up to 0.14.12, 0.15.0 up t o 0.15.17 and 0.16.0 up to 0.16.3. The cluster identity claimed by a registration request was accepted without being bound to the registration token that the request was made with. As a result, a registration request could be associated with a managed cluster that was originally registered with a different registration token.
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-104615View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Environment requirements
These conditions apply together as specified by the publisher. A matching product name alone does not establish exposure.
suse · platform conditions
Any condition may hold
Any condition may hold
Vulnerable product
cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*From (inclusive): 0.16.0
Before: 0.16.3
Vulnerable product
cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*From (inclusive): 0.15.0.
Before: 0.15.17
Vulnerable product
cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*From (inclusive): 0.14.0
Before: 0.14.12
Vulnerable product
cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*From (inclusive): 0.13
Before: 0.13.17
Vulnerable product
cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*From (inclusive): 0
Through (inclusive): 0.12
Original applicability statements
[
{
"operator": "OR",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*",
"versionStartIncluding": "0.16.0",
"versionEndExcluding": "0.16.3"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*",
"versionStartIncluding": "0.15.0.",
"versionEndExcluding": "0.15.17"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*",
"versionStartIncluding": "0.14.0",
"versionEndExcluding": "0.14.12"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*",
"versionStartIncluding": "0.13",
"versionEndExcluding": "0.13.17"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*",
"versionStartIncluding": "0",
"versionEndIncluding": "0.12"
}
]
}
]
}
]Contributing organizations · 1
Assigning organization
What changed
Follow changesLarge field values are marked as truncated previews. Original source snapshots remain retained.