All vulnerabilities
CVE-2025-23390GHSA-xgpc-q899-67p8GO-2025-3649

Fleet doesn’t validate a server’s certificate when connecting through SSH

SUSE fleetGoLibraries & packages
Open in ThreatlineRecord JSON
CVSS
6.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.19%Chance of exploitation activity in the next 30 days, higher than 8% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in0.10.12Also 0.11.7, 0.12.2CVE List
Published15 Oct 2026Updated 15 Oct 2026CVE List

What fixes it

  • 0.10.12fleetCVE List
  • 0.11.7fleetCVE List
  • 0.12.2fleetCVE List
  • 0.10.12github.com/rancher/fleet, GoOSVgo get github.com/rancher/fleet@v0.10.12
  • 0.11.7github.com/rancher/fleet, GoOSVgo get github.com/rancher/fleet@v0.11.7
  • 0.12.2github.com/rancher/fleet, GoOSVgo get github.com/rancher/fleet@v0.12.2

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

A vulnerability has been identified within Fleet where, by default, Fleet will automatically trust a remote server’s certificate when connecting through SSH if the certificate isn’t set in the known_hosts file. This could allow the execution of a man-in-the-middle (MitM) attack against Fleet. In case the server that is being connected to has a trusted entry in the known_hosts file, then Fleet will correctly check the authenticity of the presented certificate.

Text from CVE List

Affected versions 6

  • fleetaffected: 0.9.0-rc.1 before 0.10.12CVE List
  • fleetaffected: 0.11.0 before 0.11.7CVE List
  • fleetaffected: 0.12.0 before 0.12.2CVE List
  • github.com/rancher/fleet, Gofrom 0.9.0-rc.1, fixed in 0.10.12OSV
  • github.com/rancher/fleet, Gofrom 0.11.0, fixed in 0.11.7OSV
  • github.com/rancher/fleet, Gofrom 0.12.0, fixed in 0.12.2OSV

References 2