CVE-2026-41050

Description

Fleet's Helm deployer did not fully apply ServiceAccount impersonation in two code paths, allowing a tenant with git push access to a Fleet-monitored repository to read secrets from any namespace on every downstream cluster targeted by their `GitRepo`.

CVSS Vector

References

• https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-41050
• https://github.com/advisories/GHSA-765j-qfrp-hm3j