How severe is CVE-2026-93540?

CVE-2026-93540 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity high, and availability none.

Is CVE-2026-93540 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (7th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-93540?

CVE-2026-93540 affects Suse Rancher Fleet. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-93540?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2026-93540 published?

CVE-2026-93540 was published on 2026-09-28 and last updated on 2026-10-07.

CVE-2026-93540

CVE-2026-93540 is a medium-severity vulnerability in Suse Rancher Fleet with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-266.

Key facts

Severity: Medium (CVSS 3.x base score 6.5)
EPSS exploit prediction: 0% (7th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-266
Affected product: Suse Rancher Fleet
Published: 2026-09-28
Last modified: 2026-10-07

Description

A privilege mismatch was found in Fleet. When a bundle requested namespace labels or annotations through the namespaceLabels and namespaceAnnotations options, the resulting namespace metadata update was not subject to the same authorization as the rest of the bundle's deployment. As a result, a bundle could change labels and annotations on a target namespace even when the identity it was pinned to was not authorized to modify that namespace. This affected SUSE Rancher Fleet 0.16 before 0.16.2, 0.15 before 0.15.7, 0.14 before 0.14.11, 0.13 before 0.13.16 and potentially older versions.

Frequently asked questions

What is CVE-2026-93540?: A privilege mismatch was found in Fleet. When a bundle requested namespace labels or annotations through the namespaceLabels and namespaceAnnotations options, the resulting namespace metadata update was not subject to the same authorization as the rest of the bundle's deployment. As a result, a bundle could change labels and annotations on a target namespace even when the identity it was pinned to was not authorized to modify that namespace. This affected SUSE Rancher Fleet 0.16 before 0.16.2, 0.15 before 0.15.7, 0.14 before 0.14.11, 0.13 before 0.13.16 and potentially older versions.
How severe is CVE-2026-93540?: CVE-2026-93540 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity high, and availability none.
Is CVE-2026-93540 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (7th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-93540?: CVE-2026-93540 affects Suse Rancher Fleet. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-93540?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2026-93540 published?: CVE-2026-93540 was published on 2026-09-28 and last updated on 2026-10-07.

References

https://github.com/rancher/fleet/security/advisories/GHSA-m93g-8438-2cgg

Affected products (1)

cpe:2.3:a:suse:rancher_fleet:*:*:*:*:*:*:*:*

More vulnerabilities in Suse Rancher Fleet

CVE-2026-44935 — Critical (CVSS 9.9): Missing validation of "valuesFrom" references in Helm Deployer of SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before…
CVE-2026-41050 — Critical (CVSS 9.9): Fleet's Helm deployer did not fully apply ServiceAccount impersonation in two code paths, allowing a tenant with git…
CVE-2026-88808 — High (CVSS 8.8): A vulnerability has been identified within Rancher Manager where the Fleet agent wrote resources to downstream clusters…
CVE-2026-44938 — High (CVSS 8.8): A vulnerability has been identified in Fleet's agent-side deployer, which did not filter security-sensitive keys from…
CVE-2026-44937 — High (CVSS 8.2): Potential forgery of webhook requests when using a unauthenticated webhook in SUSE Rancher Fleet 0.15 before 0.15.2,…
CVE-2026-93538 — High (CVSS 7.1): A cross-tenant authorization issue was discovered in SUSE Rancher Fleet. During agent-initiated cluster registration,…

All CVEs affecting Suse Rancher Fleet →

Other CWE-266 (Incorrect Privilege Assignment) vulnerabilities

CVE-2026-39773 — Critical (CVSS 10.0): Unauthenticated Privilege Escalation in Doctreat Core <= 1.7.0 versions.
CVE-2026-105284 — Critical (CVSS 10.0): A weakness has been identified in Totolink A3002MU 1.0.0-B20230403.1455. The impacted element is the function…
CVE-2026-23800 — Critical (CVSS 10.0): Incorrect Privilege Assignment vulnerability in Modular DS modular-connector allows Privilege Escalation.This issue…
CVE-2025-41115 — Critical (CVSS 10.0): SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how organizations manage…
CVE-2024-9479 — Critical (CVSS 10.0): Improper Privilege Management vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Privilege…
CVE-2024-9478 — Critical (CVSS 10.0): Improper Privilege Management vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Privilege…

Browse all CWE-266 (Incorrect Privilege Assignment) vulnerabilities →