Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.1

Rancher Fleet Agent and related tools may allow unauthorized actions

published 5 days ago
Summary

Several Rancher‑related components, including the fleet agent, New Relic agent, LVM driver and other FIPS‑enabled packages, contained a weakness that could let an attacker cause unintended behavior or gain higher privileges. The problem has been fixed in newer versions of each package. Upgrade to the latest released version of each affected component as soon as possible.

What to do
  • Update cleanstart rancher-fleet-agent to version 0.15.4-r1.
  • Update cleanstart rancher-fleet-agent to version 0.15.4-r2.
  • Update cleanstart newrelic-infrastructure-agent to version 1.78.1-r2.
  • Update cleanstart lvm-driver to version 1.10.0-r1.
  • Update cleanstart lvm-driver to version 1.10.0-r2.
  • Update cleanstart rancher-fleet-agent to version 0.12.17-r1.
  • Update cleanstart rancher-fleet-agent to version 0.12.17-r2.
  • Update cleanstart rancher-fleet-agent to version 0.13.13-r0.
  • Update cleanstart fulcio-fips to version 1.5.1-r1.
  • Update cleanstart fluent-operator-fips to version 3.10.0-r2.
  • Update cleanstart rancher-fleet-agent to version 0.14.8-r1.
  • Update cleanstart rancher-fleet-agent to version 0.14.8-r2.
  • Update cleanstart temporal-server to version 1.28.4-r1.
  • Update cleanstart temporal-server to version 1.29.7-r1.
  • Update cleanstart litestream to version 0.3.14-r2.
  • Update cleanstart litestream to version 0.3.14-r3.
  • Update cleanstart metrics-server-fips to version 0.8.1-r2.
  • Update cleanstart trillian-fips to version 1.7.3-r1.
  • Update cleanstart distribution to version 3.1.1-r1.
  • Update cleanstart melange to version 0.55.0-r1.
  • Update cleanstart tempo-fips to version 3.0.2-r1.
  • Update cleanstart consul-fips to version 2.0.1-r1.
  • Update cleanstart crossplane-provider-sql-fips to version 0.15.0-r2.
  • Update cleanstart crossplane-provider-sql-fips to version 0.15.0-r3.
  • Update cleanstart falco-exporter to version 0.8.7-r2.
  • Update cleanstart k8sgpt-operator to version 0.2.27-r1.
  • Update cleanstart kubernetes-csi-external-resizer-fips to version 2.2.1-r1.
  • Update cleanstart promxy to version 0.0.96-r3.
  • Update cleanstart promxy to version 0.0.96-r2.
  • Update cleanstart cadvisor-fips to version 0.60.3-r1.
  • Update cleanstart consul-k8s-fips to version 1.8.14-r1.
  • Update cleanstart distribution-fips to version 3.1.1-r1.
  • Update cleanstart kaniko to version 1.24.0-r2.
  • Update cleanstart prometheus-adapter to version 0.12.0-r1.
  • Update cleanstart yunikorn-k8shim-fips to version 1.8.0-r2.
  • Update cleanstart multus-cni-fips to version 4.3.0-r1.
Affected software
Ecosystem VendorProductAffected versions
CleanStart cleanstart rancher-fleet-agent < 0.15.4-r1
< 0.15.4-r2
< 0.12.17-r1
< 0.12.17-r2
< 0.13.13-r0
< 0.14.8-r1
< 0.14.8-r2
Fix: upgrade to 0.15.4-r1
CleanStart cleanstart newrelic-infrastructure-agent < 1.78.1-r2
Fix: upgrade to 1.78.1-r2
CleanStart cleanstart lvm-driver < 1.10.0-r1
< 1.10.0-r2
Fix: upgrade to 1.10.0-r1
CleanStart cleanstart fulcio-fips < 1.5.1-r1
Fix: upgrade to 1.5.1-r1
CleanStart cleanstart fluent-operator-fips < 3.10.0-r2
Fix: upgrade to 3.10.0-r2
CleanStart cleanstart temporal-server < 1.28.4-r1
< 1.29.7-r1
Fix: upgrade to 1.28.4-r1
CleanStart cleanstart litestream < 0.3.14-r2
< 0.3.14-r3
Fix: upgrade to 0.3.14-r2
CleanStart cleanstart metrics-server-fips < 0.8.1-r2
Fix: upgrade to 0.8.1-r2
CleanStart cleanstart trillian-fips < 1.7.3-r1
Fix: upgrade to 1.7.3-r1
CleanStart cleanstart distribution < 3.1.1-r1
Fix: upgrade to 3.1.1-r1
CleanStart cleanstart melange < 0.55.0-r1
Fix: upgrade to 0.55.0-r1
CleanStart cleanstart tempo-fips < 3.0.2-r1
Fix: upgrade to 3.0.2-r1
CleanStart cleanstart consul-fips < 2.0.1-r1
Fix: upgrade to 2.0.1-r1
CleanStart cleanstart crossplane-provider-sql-fips < 0.15.0-r2
< 0.15.0-r3
Fix: upgrade to 0.15.0-r2
CleanStart cleanstart falco-exporter < 0.8.7-r2
Fix: upgrade to 0.8.7-r2
CleanStart cleanstart k8sgpt-operator < 0.2.27-r1
Fix: upgrade to 0.2.27-r1
CleanStart cleanstart kubernetes-csi-external-resizer-fips < 2.2.1-r1
Fix: upgrade to 2.2.1-r1
CleanStart cleanstart promxy < 0.0.96-r3
< 0.0.96-r2
Fix: upgrade to 0.0.96-r3
CleanStart cleanstart cadvisor-fips < 0.60.3-r1
Fix: upgrade to 0.60.3-r1
CleanStart cleanstart consul-k8s-fips < 1.8.14-r1
Fix: upgrade to 1.8.14-r1
CleanStart cleanstart distribution-fips < 3.1.1-r1
Fix: upgrade to 3.1.1-r1
CleanStart cleanstart kaniko < 1.24.0-r2
Fix: upgrade to 1.24.0-r2
CleanStart cleanstart prometheus-adapter < 0.12.0-r1
Fix: upgrade to 0.12.0-r1
CleanStart cleanstart yunikorn-k8shim-fips < 1.8.0-r2
Fix: upgrade to 1.8.0-r2
CleanStart cleanstart multus-cni-fips < 4.3.0-r1
Fix: upgrade to 4.3.0-r1
Original advisory text
Security fix for GHSA-hrxh-6v49-42gf applied in: rancher-fleet-agent 0.15.4-r1, rancher-fleet-agent 0.15.4-r2, newrelic-infrastructure-agent 1.78.1-r2, lvm-driver 1.10.0-r1, lvm-driver 1.10.0-r2, rancher-fleet-agent 0.12.17-r1, rancher-fleet-agent 0.12.17-r2, rancher-fleet-agent 0.13.13-r0, fulcio-fips 1.5.1-r1, fluent-operator-fips 3.10.0-r2, rancher-fleet-agent 0.14.8-r1, rancher-fleet-agent 0.14.8-r2, temporal-server 1.28.4-r1, temporal-server 1.29.7-r1, litestream 0.3.14-r2, litestream 0.3.14-r3, metrics-server-fips 0.8.1-r2, trillian-fips 1.7.3-r1, distribution 3.1.1-r1, melange 0.55.0-r1, tempo-fips 3.0.2-r1, consul-fips 2.0.1-r1, crossplane-provider-sql-fips 0.15.0-r2, crossplane-provider-sql-fips 0.15.0-r3, falco-exporter 0.8.7-r2, k8sgpt-operator 0.2.27-r1, kubernetes-csi-external-resizer-fips 2.2.1-r1, promxy 0.0.96-r3, promxy 0.0.96-r2, cadvisor-fips 0.60.3-r1, consul-k8s-fips 1.8.14-r1, distribution-fips 3.1.1-r1, kaniko 1.24.0-r2, prometheus-adapter 0.12.0-r1, yunikorn-k8shim-fips 1.8.0-r2, multus-cni-fips 4.3.0-r1
GHSA-hrxh-6v49-42gf affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
9.1 Critical
Timeline
Published30 Oct 2026
Updated31 Oct 2026
First seen31 Oct 2026
Sources
CLEANSTART-2026-WG10458 · OSV
Track software like this
Free during beta