SUSE Fleet: Plain Text Storage of Vulnerability Exploit Helm Values

A high-severity vulnerability in SUSE’s Fleet, a GitOps management tool for Kubernetes clusters, has been disclosed by security researcher samjustus via GitHub Security Advisory GHSA-6h9x-9j5v-7w9h. The vulnerability, tracked as CVE-2024-52284, allows Helm chart values—often containing sensitive credentials—to be stored inside BundleDeployment resources in plain text, exposing them to any user with GET or LIST permissions.

According to the disclosed details, the CVSS v3.1 base score is 7.4 (High), with Network attack vector, Low attack complexity, Low privileges required, and no user interaction. Fleet versions prior to 0.14.0 are affected (specifically 0.11.x, 0.12.x, and 0.13.x ranges), with patches in 0.14.0, 0.13.1, 0.12.6, and 0.11.10.

The update introduces a mechanism where Fleet creates a dedicated Kubernetes Secret for each BundleDeployment’s Helm values, ensuring they are no longer stored in plain text within CRD objects, and the Fleet controller now retrieves values from that Secret rather than from the BundleDeployment spec. Immediate mitigations include upgrading Fleet to v0.14.0 or later, auditing BundleDeployments, enabling encryption at rest, and reviewing RBAC to restrict GET and LIST operations.