Vulnerability · Published Oct 15, 2026 · Assigned by suse
CVE-2025-23390Fleet doesn’t validate a server’s certificate when connecting through SSH
Medium 6.3
In plain English
A medium-severity improper certificate validation in fleet from SUSE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A vulnerability has been identified within Fleet where, by default, Fleet will automatically trust a remote server’s certificate when connecting through SSH if the certificate isn’t set in the `known_hosts` file. This could allow the execution of a man-in-the-middle (MitM) attack against Fleet. In case the server that is being connected to has a trusted entry in the known_hosts file, then Fleet will correctly check the authenticity of the presented certificate.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/rancher/fleet | 0.10.12 | GHSA-xgpc-q899-67p8 |
| Go | github.com/rancher/fleet | 0.11.7 | GHSA-xgpc-q899-67p8 |
| Go | github.com/rancher/fleet | 0.12.2 | GHSA-xgpc-q899-67p8 |
| Go | github.com/rancher/fleet | 0.10.12, 0.11.7, 0.12.2 | GO-2025-3649 |
Affected products (as reported)
Weakness: CWE-295 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L