All vulnerabilities
CVE-2023-32198GHSA-95fc-g4gj-mqmxGO-2025-3648

Steve doesn’t verify a server’s certificate and is susceptible to man-in-the-middle (MitM) attacks

SUSE steveGoLibraries & packages
Open in ThreatlineRecord JSON
CVSS
8.0High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.33%Chance of exploitation activity in the next 30 days, higher than 24% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in0.2.1Also 0.3.3, 0.4.4 and 1 moreCVE List
Published15 Oct 2026Updated 15 Oct 2026CVE List

What fixes it

  • 0.2.1steveCVE List
  • 0.3.3steveCVE List
  • 0.4.4steveCVE List
  • 0.5.13steveCVE List
  • 0.2.1github.com/rancher/steve, GoOSVgo get github.com/rancher/steve@v0.2.1
  • 0.3.3github.com/rancher/steve, GoOSVgo get github.com/rancher/steve@v0.3.3
Show all 8 fixed versions
  • 0.4.4github.com/rancher/steve, GoOSVgo get github.com/rancher/steve@v0.4.4
  • 0.5.13github.com/rancher/steve, GoOSVgo get github.com/rancher/steve@v0.5.13

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

A vulnerability has been identified in Steve where by default it was using an insecure option that did not validate the certificate presented by the remote server while performing a TLS connection. This could allow the execution of a man-in-the-middle (MitM) attack against services using Steve.

Text from CVE List

Affected versions 8

  • steveaffected: 0.2.0 before 0.2.1CVE List
  • steveaffected: 0.3.0 before 0.3.3CVE List
  • steveaffected: 0.4.0 before 0.4.4CVE List
  • steveaffected: 0.5.0 before 0.5.13CVE List
  • github.com/rancher/steve, Gofrom 0.2.0, fixed in 0.2.1OSV
  • github.com/rancher/steve, Gofrom 0.3.0, fixed in 0.3.3OSV
  • github.com/rancher/steve, Gofrom 0.4.0, fixed in 0.4.4OSV
  • github.com/rancher/steve, Gofrom 0.5.0, fixed in 0.5.13OSV

References 2