CVE-2026-44938: Fleet Agent Authorization Bypass Vulnerability

CVE-2026-44938 Overview

CVE-2026-44938 affects Fleet's agent-side deployer, a GitOps controller used to manage Kubernetes workloads at scale. The deployer does not filter security-sensitive keys from namespaceLabels defined in fleet.yaml or in BundleDeployment.spec.options.namespaceLabels before applying them to a target namespace. An attacker with git push access to a Fleet-monitored repository can overwrite Pod Security Standards (PSS) enforcement labels on a target namespace. This weakens Kubernetes admission controls and permits deployment of workloads that PSS policies would otherwise block. The weakness is classified under CWE-522: Insufficiently Protected Credentials.

Critical Impact
A user with push access to a Fleet-monitored repository can disable Pod Security Standards enforcement on target namespaces and deploy privileged workloads that bypass cluster admission controls.

Affected Products

Rancher Fleet (agent-side deployer)
Kubernetes clusters managed by Fleet with namespaceLabels configured
Workloads relying on Pod Security Standards enforcement on Fleet-managed namespaces

Discovery Timeline

2026-07-07 - CVE-2026-44938 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-44938

Vulnerability Analysis

Fleet uses a declarative model where a Git repository contains a fleet.yaml file describing how bundles should be deployed to downstream clusters. Among the configurable options is namespaceLabels, a map of labels applied to the destination namespace. The agent-side deployer applies these labels without filtering keys reserved for security enforcement.

Kubernetes uses labels in the pod-security.kubernetes.io/ namespace to configure Pod Security Standards. Labels such as pod-security.kubernetes.io/enforce, pod-security.kubernetes.io/audit, and pod-security.kubernetes.io/warn govern which pods the admission controller permits. When Fleet overwrites these labels with attacker-controlled values, the PSS admission policy is downgraded or removed.

Root Cause

The deployer treats namespaceLabels as arbitrary user data and merges it directly into the namespace object. No allowlist or denylist filters keys that carry admission-control semantics. Any user permitted to modify fleet.yaml inherits the ability to mutate namespace-level security posture through the Fleet agent's elevated permissions.

Attack Vector

An attacker requires write access to a Git repository monitored by Fleet. The attacker commits a modified fleet.yaml that sets namespaceLabels such as pod-security.kubernetes.io/enforce: privileged. When the Fleet agent reconciles the bundle, it applies the label to the target namespace using the agent's service account permissions. Subsequent workloads in that namespace bypass restricted or baseline PSS enforcement, enabling privileged pods, host-path mounts, or host-namespace sharing.

The vulnerability is exploitable over the network because Fleet pulls configuration from remote Git sources. The attack requires low privileges (repository write access) and no user interaction. The impact spans confidentiality, integrity, and availability of workloads in affected namespaces.

No public proof-of-concept code has been released. Refer to the GitHub Security Advisory GHSA-864g-863m-vcvq and the SUSE Bug Report for CVE-2026-44938 for authoritative technical details.

Detection Methods for CVE-2026-44938

Indicators of Compromise

Unexpected changes to pod-security.kubernetes.io/enforce, audit, or warn labels on Fleet-managed namespaces
fleet.yaml or BundleDeployment manifests containing namespaceLabels keys prefixed with pod-security.kubernetes.io/
Kubernetes audit log entries showing the Fleet agent service account patching namespace labels outside expected values
Deployment of pods with privileged: true, hostNetwork: true, or host-path mounts in namespaces previously enforcing restricted PSS

Detection Strategies

Audit Git repositories monitored by Fleet for namespaceLabels entries that reference Pod Security Standards keys.
Enable Kubernetes API server audit logging and alert on patch and update operations against namespace objects performed by the Fleet agent identity.
Compare declared namespace security posture in cluster policy-as-code (OPA, Kyverno) against live namespace labels to detect drift.

Monitoring Recommendations

Forward Kubernetes audit logs and Git commit events into a centralized analytics platform to correlate repository changes with cluster state.
Track service account activity for Fleet controllers and alert on label modifications targeting security-sensitive keys.
Monitor admission controller decisions for a sudden drop in denied pods, which can indicate weakened PSS enforcement.

How to Mitigate CVE-2026-44938

Immediate Actions Required

Upgrade Fleet to a version that filters security-sensitive keys from namespaceLabels as described in GHSA-864g-863m-vcvq.
Restrict write access to Fleet-monitored Git repositories to trusted maintainers and require signed commits with mandatory code review.
Audit existing fleet.yaml and BundleDeployment manifests for pod-security.kubernetes.io/* labels and remove unauthorized entries.
Reapply intended Pod Security Standards labels to any namespace whose enforcement level was altered.

Patch Information

Rancher and SUSE have published fixes coordinated through the security advisories linked above. Consult the GitHub Security Advisory GHSA-864g-863m-vcvq for fixed version numbers and the SUSE Bug Report for CVE-2026-44938 for distribution-specific update details.

Workarounds

Enforce Pod Security Standards using a validating admission policy (Kyverno or OPA Gatekeeper) that rejects namespace mutations attempting to lower PSS enforcement, independent of Fleet.
Reduce the RBAC permissions granted to the Fleet agent service account so it cannot patch namespace metadata on protected namespaces.
Segregate high-sensitivity workloads into namespaces not managed by Fleet until the patched version is deployed.

bash

# Example Kyverno policy fragment to block modification of PSS labels on protected namespaces
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: block-pss-label-override
spec:
  validationFailureAction: Enforce
  rules:
    - name: deny-pss-label-changes
      match:
        any:
          - resources:
              kinds:
                - Namespace
      validate:
        message: "Modification of pod-security.kubernetes.io labels is not permitted."
        deny:
          conditions:
            any:
              - key: "{{ request.object.metadata.labels.\"pod-security.kubernetes.io/enforce\" }}"
                operator: NotEquals
                value: "{{ request.oldObject.metadata.labels.\"pod-security.kubernetes.io/enforce\" }}"