Missing validation of "valuesFrom" references in Helm Deployer of SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before…

A missing validation vulnerability exists in the Helm Deployer component of SUSE Rancher Fleet affecting versions 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11, and 0.12 before 0.12.15. The flaw involves improper validation of 'valuesFrom' references, which can be exploited by owners of one tenant to access fleet credentials belonging to other tenants. This represents a cross-tenant credential exposure risk in multi-tenant Rancher Fleet deployments. The vulnerability has been assigned CVE-2026-44935 and is currently awaiting full analysis on NVD. Patched versions have been released for all affected branches. Organizations using SUSE Rancher Fleet in multi-tenant configurations should upgrade immediately to mitigate the risk of credential theft.