NuytsTech Security

CVE-2026-41050

by ·

Fleet’s Helm deployer did not fully apply ServiceAccount impersonation in two code paths, allowing a tenant with git push access to a Fleet-monitored repository to read secrets from any namespace on every downstream cluster targeted by their `GitRepo`.

More information : https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-41050

Tags: