data/reports/GO-2026-5207.yaml

id: GO-2026-5207
modules:
    - module: github.com/rancher/fleet
      versions:
        - introduced: 0.11.0
        - fixed: 0.11.13
        - introduced: 0.12.0
        - fixed: 0.12.14
        - introduced: 0.13.0
        - fixed: 0.13.10
        - introduced: 0.14.0
        - fixed: 0.14.5
        - introduced: 0.15.0
        - fixed: 0.15.1
      vulnerable_at: 0.15.1-rc.2
summary: |-
    Fleet: Helm impersonation bypass of `RESTClientGetter` retains `cluster-admin`
    during template rendering in github.com/rancher/fleet
cves:
    - CVE-2026-41050
ghsas:
    - GHSA-765j-qfrp-hm3j
references:
    - advisory: https://github.com/rancher/fleet/security/advisories/GHSA-765j-qfrp-hm3j
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-41050
    - web: https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-41050
source:
    id: GHSA-765j-qfrp-hm3j
    created: 2026-06-25T01:58:13.192958868-04:00
review_status: UNREVIEWED