{"id":"CVE-2026-104615","aliases":["EUVD-2026-114135","GHSA-gx8v-2929-9q95"],"status":"published","title":"Cluster identity takeover in Fleet cluster registration allows access to another cluster's Fleet namespace","description":"A security vulnerability was discovered in SUSE Rancher Fleet's cluster registration flow, in Fleet versions before 0.12, 0.13.0 up to 0.13.17, 0.14.0 up to 0.14.12, 0.15.0 up t o 0.15.17 and 0.16.0 up to 0.16.3. The cluster identity claimed by a registration request was accepted without being bound to the registration token that the request was made with. As a result, a registration request could be associated with a managed cluster that was originally registered with a different registration token.","severity":{"version":"3.1","score":7.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00221,"percentile":0.1284,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-290"],"published":"2026-10-30T15:49:01Z","modified":"2026-11-06T16:23:32Z","products":[{"vendor":"suse","product":"rancher"}],"references":[{"url":"https://github.com/rancher/fleet/security/advisories/GHSA-gx8v-2929-9q95","tags":["vendor-advisory","advisory"]},{"url":"https://github.com/rancher/fleet/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-104615.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104615","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-104615","title":"Cluster identity takeover in Fleet cluster registration allows access to another cluster's Fleet namespace","description":"A security vulnerability was discovered in SUSE Rancher Fleet's cluster registration flow, in Fleet versions before 0.12, 0.13.0 up to 0.13.17, 0.14.0 up to 0.14.12, 0.15.0 up t o 0.15.17 and 0.16.0 up to 0.16.3. The cluster identity claimed by a registration request was accepted without being bound to the registration token that the request was made with. As a result, a registration request could be associated with a managed cluster that was originally registered with a different registration token.","status":"published","published":"2026-10-30T15:49:01.402Z","modified":"2026-11-06T16:23:32.584Z","cvss":[{"version":"3.1","score":7.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-290"],"updated_at":"2026-11-06T17:28:52.192546Z"}],"euvd":[{"id":"EUVD-2026-114135","description":"A security vulnerability was discovered in SUSE Rancher Fleet's cluster registration flow, in Fleet versions before 0.12, 0.13.0 up to 0.13.17, 0.14.0 up to 0.14.12, 0.15.0 up t o 0.15.17 and 0.16.0 up to 0.16.3. The cluster identity claimed by a registration request was accepted without being bound to the registration token that the request was made with. As a result, a registration request could be associated with a managed cluster that was originally registered with a different registration token.","status":"published","published":"2026-10-30T15:49:01Z","modified":"2026-11-06T16:23:32Z","cvss":[{"version":"3.1","score":7.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:H","level":"high"}],"updated_at":"2026-11-06T17:05:28.701654Z"}],"nvd":[{"id":"CVE-2026-104615","description":"A security vulnerability was discovered in SUSE Rancher Fleet's cluster registration flow, in Fleet versions before 0.12, 0.13.0 up to 0.13.17, 0.14.0 up to 0.14.12, 0.15.0 up t o 0.15.17 and 0.16.0 up to 0.16.3. The cluster identity claimed by a registration request was accepted without being bound to the registration token that the request was made with. As a result, a registration request could be associated with a managed cluster that was originally registered with a different registration token.","status":"published","published":"2026-10-30T16:17:36.687Z","modified":"2026-11-06T17:17:11.053Z","cvss":[{"version":"3.1","score":7.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-290"],"updated_at":"2026-11-06T20:01:16.0125Z"}],"osv":[{"id":"CVE-2026-104615","title":"Cluster identity takeover in Fleet cluster registration allows access to another cluster's Fleet namespace","description":"A security vulnerability was discovered in SUSE Rancher Fleet's cluster registration flow, in Fleet versions before 0.12, 0.13.0 up to 0.13.17, 0.14.0 up to 0.14.12, 0.15.0 up t o 0.15.17 and 0.16.0 up to 0.16.3. The cluster identity claimed by a registration request was accepted without being bound to the registration token that the request was made with. As a result, a registration request could be associated with a managed cluster that was originally registered with a different registration token.","status":"published","published":"2026-10-30T15:49:01.402Z","modified":"2026-11-08T02:30:43.74180029Z","cvss":[{"version":"3.1","score":7.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:H","level":"high"}],"cwes":["CWE-290"],"updated_at":"2026-11-07T03:07:59.773479Z"}]}}