CVE-2026-41050 — Helm impersonation bypass of `RESTClientGetter` retains `cluster-admin` during template rendering
Fleet's Helm deployer did not fully apply ServiceAccount impersonation in two code paths, allowing a tenant with git push access to a Fleet-monitored repository to read secrets …
Published: 2026-05-13 · CVSS: 9.9 · CVSS 3.1
Fleet's Helm deployer did not fully apply ServiceAccount impersonation in two code paths, allowing a tenant with git push access to a Fleet-monitored repository to read secrets from any namespace on every downstream cluster targeted by their `GitRepo`.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7