Package
harvester-fips-webhook
Component
github.com/rancher/rancher
Latest update
Fixed version
1.8.1-r28
8.8
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Fixed version
1.8.1-r28Status
Impact
This CVE is carried by the bundled github.com/rancher/rancher dependency and cannot be remediated as a package-level bump against harvester v1.8.1, which hard-pins its Kubernetes stack via go.mod replace directives (k8s.io/* => v0.33.7, cluster-api v1.9.5, controller-runtime v0.21.0). The earliest rancher revision containing the fix (d0c047bbc6d2) is built against Kubernetes 0.35.5 / cluster-api v1.12.2 — two minors ahead — and cluster-api ≥v1.12 removed the api/v1beta1 package harvester'''s own code imports; bumping rancher therefore fails to compile. Same blocker as CVE-2026-41052 (k8s 0.35.4) and CVE-2025-67601 (cluster-api v1.12+). Pending upstream: resolves when harvester migrates off api/v1beta1 onto the Kubernetes 0.35+/cluster-api ≥v1.12 stack (v1.8.2 / v1.9.0).
Status