CyberRota Analysis
AI-GeneratedA vulnerability exists in Fleet's agent-side deployer, allowing an attacker with git push access to a monitored repository to manipulate security-sensitive keys in namespaceLabels. This exploitation can lead to the overwriting of Pod Security Standards enforcement labels, potentially weakening admission controls and enabling the deployment of unauthorized workloads. Organizations using Fleet should prioritize addressing this vulnerability to maintain robust security posture and compliance with PSS policies.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A vulnerability has been identified in Fleet's agent-side deployer, which did not filter security-sensitive keys from namespaceLabels in fleet.yaml (or BundleDeployment.spec.options.namespaceLabels) when applying them to the target namespace. An attacker with git push access to a Fleet-monitored repository could overwrite Pod Security Standards (PSS) enforcement labels on a target namespace. This allows the attacker to weaken admission controls and deploy workloads that PSS policies would otherwise block.