CVE-2026-93539: Unauthenticated GitRepo Spec Mutation via Fleet Git Webhook Receiver
A vulnerability was discovered in Fleet's Git webhook receiver (the gitjob webhook service). When a webhook secret is not configured, incoming webhook requests are accepted without verification, and processing a request can change the spec.pollingInterval field of a matching GitRepo resource in any namespace. A caller with network access to the webhook service and no Kubernetes credentials can therefore alter GitRepo configuration outside
the namespaces they are authorized for. This only affects SUSE Rancher Fleet 0.16 before 0.16.2, older versions are not affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SUSE Rancher Fleetto a version that resolves this vulnerability.Fixed in 0.16.2 - Configuration
Configure a webhook secret so incoming webhook requests are verified.
Fleet Git webhook receiver webhook secret = configured
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
SUSE Rancher Fleet 0.16 releases before 0.16.2 are affected only when the Git webhook receiver is reachable by an attacker and no webhook secret is configured. Older Fleet versions are not affected.
What access does an attacker need?
An attacker needs network access to the gitjob webhook service. They do not need Kubernetes credentials when webhook verification is disabled by the absence of a configured secret.
What can be changed through successful exploitation?
A crafted webhook request can modify the spec.pollingInterval field on a matching GitRepo resource. The affected GitRepo can be in any namespace, including namespaces outside the caller's authorized scope.
What can be done before upgrading?
Configure a webhook secret so incoming requests are verified, and restrict network access to the gitjob webhook service. Upgrade affected Fleet 0.16 installations to 0.16.2 or later when possible.