CVE-2026-41050
CRITICAL
NVD
CVSS Score
9.9
Severity
CRITICAL
Published
May 13, 2026
Vendor
unknown
Description
Fleet's Helm deployer did not fully apply ServiceAccount impersonation in two code paths, allowing a tenant with git push access to a Fleet-monitored repository to read secrets from any namespace on every downstream cluster targeted by their `GitRepo`.