Fleet applies namespace labels and annotations without the bundle's service account privileges

Description

A privilege mismatch was found in Fleet. When a bundle requested namespace labels or annotations through the namespaceLabels and namespaceAnnotations options, the resulting namespace metadata update was not subject to the same authorization as the rest of the bundle's deployment. As a result, a bundle could change labels and annotations on a target namespace even when the identity it was pinned to was not authorized to modify that namespace. This affected SUSE Rancher Fleet 0.16 before 0.16.2, 0.15 before 0.15.7, 0.14 before 0.14.11, 0.13 before 0.13.16 and potentially older versions.

Scores

EPSS (exploitation in 30 days)

0.17% · top 93% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.5.

Weakness

• CWE-266 Incorrect privilege assignment (opens in a new tab)All about CWE-266 and its CVEs

Affected products

• SUSE · Rancher

  • affected 0.16.0 – < 0.16.1
  • affected 0.15.0 – < 0.15.7
  • affected 0.14.0 – < 0.14.11
  • affected 0.13.0 – < 0.13.16

References (1)

• https://github.com/rancher/fleet/security/advisories/GHSA-m93g-8438-2cgg (opens in a new tab)vendor-advisory

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-93540](https://trackcve.app/badge/CVE-2026-93540.svg)](https://trackcve.app/cve/CVE-2026-93540)

Record last updated 28 Sept 2026, 16:22 UTC.