Summary
A cross-tenant authorization weakness in SUSE Rancher Fleet allows labels supplied during agent-initiated cluster registration to influence cluster-targeting decisions. If an untrusted party can register a cluster in a Fleet workspace shared with other tenants, the cluster may satisfy GitRepo or Bundle targeting rules intended for another cluster.
Affected context
The issue occurs in Fleet deployments where multiple tenants share a workspace namespace and cluster registration accepts labels from the registering agent. It becomes risky when labels in the reserved management.cattle.io/ namespace are copied to the upstream Cluster object and Fleet uses those labels to resolve GitRepo or Bundle targets.
Exploit preconditions
- Attack surface: Agent-initiated cluster registration in a shared Fleet workspace
- Required access: Ability to register a cluster in a workspace used by other tenants
- Trigger point: Creation of the upstream Cluster object and subsequent GitRepo or Bundle target evaluation
- Why exploitation is possible: Agent-controlled labels, including reserved management labels, can affect authorization-relevant target matching
Why this happens
The underlying bug is an authorization boundary failure caused by trusting caller-supplied metadata when making resource-targeting decisions. Fleet applied registration labels from an untrusted agent to an upstream Cluster object, and later used those labels to determine which GitRepo and Bundle resources matched the cluster. This maps primarily to CWE-639: Authorization Bypass Through User-Controlled Key, because attacker-influenced attributes acted as authorization-relevant selectors across tenant boundaries.
Potential impact
- A tenant's cluster may receive Git-based configuration intended for another tenant
- Unauthorized workloads or application settings could be deployed to a cluster
- Tenant isolation and configuration confidentiality may be weakened
- Attackers could cause configuration drift, data exposure, or workload disruption
General mitigation guidance
Mitigation generally focuses on separating registration metadata from trusted authorization attributes.
Defensive patterns include:
- Treating agent-provided labels as untrusted data rather than tenant identity or policy selectors
- Preventing callers from setting reserved management namespaces during registration
- Allowing only controller-generated or administrator-approved labels to influence targeting
- Binding GitRepo and Bundle selection to immutable cluster identity and tenant context
- Applying explicit workspace and namespace isolation between tenants
- Enforcing least privilege for registration agents and deployment controllers
- Revalidating authorization context whenever cluster metadata is copied or transformed
How teams detect issues like this
Organizations can look for this class of issue through:
- Static analysis and review rules identifying authorization decisions based on user-controlled labels or annotations
- Code review checks for copying caller-supplied metadata into trusted resource fields
- Tests that attempt cross-tenant target matching using conflicting or reserved labels
- Admission policies that block untrusted writes to reserved management namespaces
- Audit monitoring for cluster registrations and unexpected GitRepo or Bundle assignments
- Policy enforcement that requires immutable tenant and cluster identity attributes for resource targeting
Automated security review tools may help identify data flows from registration inputs into authorization and reconciliation logic.
