CVE-2026-44938: Fleet GitOps Pod Security Standards Bypass

Technical summary

CVE-2026-44938 affects Fleet's agent-side deployer component, which fails to filter security-sensitive keys when processing namespaceLabels from fleet.yaml or BundleDeployment.spec.options.namespaceLabels before applying them to target namespaces. Specifically, the deployer does not sanitize labels used by Pod Security Standards (such as pod-security.kubernetes.io/* labels), allowing an attacker with Git repository write access to overwrite PSS enforcement labels. This bypasses admission controller restrictions that rely on namespace-level PSS labels to enforce restricted, baseline, or unrestricted security postures.

Business impact

This vulnerability enables privilege escalation and unauthorized workload deployment within Kubernetes clusters managed by Fleet. An insider or compromised developer account with repository access can circumvent security policies meant to prevent high-risk container configurations—including those running as root, with privileged capabilities, or with unsafe system call access. The impact extends to any application or data in the affected namespace and potentially across the cluster if workloads can exploit escalated permissions.

Affected systems

Fleet deployments that use fleet.yaml or BundleDeployment configurations to manage namespace labels are affected. The vulnerability applies to all environments where Fleet agents apply configuration from Git repositories, particularly those relying on Pod Security Standards as a defense layer. Organizations using Fleet for GitOps-driven Kubernetes management should assume their clusters are in scope.

Exploitability

Exploitation requires Git push access to a Fleet-monitored repository—a relatively common privilege for developers, CI/CD systems, or compromised accounts. No network access to the cluster API is required; the attack is indirect and deferred until the next Fleet sync. The low complexity and high impact make this a practical concern in multi-tenant or shared repository environments.

Remediation

Upgrade Fleet to a patched version that filters or validates namespaceLabels to prevent modification of Pod Security Standards enforcement labels. Until patching is complete, restrict Git repository write access to trusted personnel, implement code review requirements for fleet.yaml changes, and monitor namespace label modifications for unexpected PSS policy overwrites. Consider deploying an additional admission controller or policy engine (such as Kyverno or OPA) that independently enforces PSS policies at the cluster level, making them resistant to namespace-level tampering.

Patch guidance

Consult the Fleet project's security advisory for the specific patched version. Verify the fix validates or filters keys matching pod-security.kubernetes.io/* patterns and other security-critical namespace labels before application. Test the patch in a non-production cluster to confirm that legitimate namespace label configurations continue to work. Plan a coordinated rollout to minimize cluster disruption.

Detection guidance

Monitor audit logs for CreateNamespace or PatchNamespace events containing pod-security.kubernetes.io/* labels that differ from your organization's PSS policy baseline. Review Git commit history for unexpected changes to fleet.yaml files, especially modifications to the namespaceLabels section. Use kubectl to periodically check actual namespace labels against your intended PSS posture. Alert on namespace labels that weaken Pod Security Standards (e.g., changing from 'restricted' to 'unrestricted' or removal of enforce/audit labels).

Why prioritize this

This is a HIGH-severity vulnerability (CVSS 8.8) that combines privileged access requirements with substantial confidentiality, integrity, and availability impact. While it requires an authenticated repository contributor, the ability to bypass security controls protecting the entire namespace makes it a critical priority for any organization using Fleet with PSS as part of their defense strategy. The deferred, automation-driven nature of the attack means detection and prevention are challenging without additional controls.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects a network-accessible attack requiring low privileges (developer or CI/CD system credentials), no user interaction, and high impact across all three security dimensions. The score appropriately captures the severity of breaking admission control mechanisms, even though attack prerequisites (Git access) are moderate. Organizations should treat this as urgent if Pod Security Standards are relied upon as a key security control.

Frequently asked questions