Affected by GO-2026-5207
and 4 other vulnerabilities
GO-2026-5207: Fleet: Helm impersonation bypass of `RESTClientGetter` retains `cluster-admin` during template rendering in github.com/rancher/fleet
GO-2026-5871: Fleet has PSS Bypass through addLabelsFromOptions in Fleet Agent in github.com/rancher/fleet
GO-2026-5873: Rancher Fleet has SSRF in Bundle Reader via Unvalidated Helm Repository URL in fleet.yaml in github.com/rancher/fleet
GO-2026-5874: Rancher Fleet has Unauthenticated Webhook: Regex Injection via Unsanitized Repository URL Components in github.com/rancher/fleet
GO-2026-5877: Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm Deployer in github.com/rancher/fleet
Merge combines multiple label selectors by merging match labels and expressions.
When the same label key appears in multiple selectors with different values, the last value wins.
Duplicate match expressions are collapsed; conflicting expressions remain and will match nothing.
Returns nil if all input selectors are nil.
Affected by 
Documentation
¶
Source Files