GHSA-qfmw-gw96-ffcr

Facts

Severity

Critical · CVSS score 9.4CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Package name (github.com/rancher/fleet)

github.com/rancher/fleetAs entered. Cleaned up for matching.

Affected versions (github.com/rancher/fleet)

>=0.16.0, <0.16.3As entered by the maintainer. Not reviewed.

Fixed in (github.com/rancher/fleet)

0.16.3

Package name (github.com/rancher/fleet)

github.com/rancher/fleetAs entered. Cleaned up for matching.

Affected versions (github.com/rancher/fleet)

>=0.15.0, <0.15.8As entered by the maintainer. Not reviewed.

Fixed in (github.com/rancher/fleet)

0.15.8

Package name (github.com/rancher/fleet)

github.com/rancher/fleetAs entered. Cleaned up for matching.

Affected versions (github.com/rancher/fleet)

>=0.14.0, <0.14.12As entered by the maintainer. Not reviewed.

Fixed in (github.com/rancher/fleet)

0.14.12

Package name (github.com/rancher/fleet)

github.com/rancher/fleetAs entered. Cleaned up for matching.

Affected versions (github.com/rancher/fleet)

>=v0.13.0, <0.13.17As entered by the maintainer. Not reviewed.

Fixed in (github.com/rancher/fleet)

0.13.17

CVE

CVE-2026-94290 · published

GitHub Advisory Database

Not reviewed

OSV.dev

Not present

Other CVEs pointing here

None found in the CVE List

Timeline

1. 2026-10-29 17:26 UTC

   Published by the maintainers

   Cites CVE-2026-94290

2. 2026-11-02 16:20 UTC

   Change recorded

   CVE-2026-94290 RESERVED -> PUBLISHED

3. 2026-10-30 13:09 UTC

   First seen by Limbowatch

   not reviewed · not in OSV

4. Waiting

   Reviewed by GitHub

5. Waiting

   In OSV; scanners can see it

Machine-readable record: feed/GHSA-qfmw-gw96-ffcr.json