Read the docs
TI-2023-30888 Aliases CVE-2023-32198

Steve does not verify server certificates, enabling MitM attacks

Priority LOW 37CWE-295Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
High
Impact type
Spoofing
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-295.

Summary

SUSE steve from 0.2.0 before 0.2.1, from 0.3.0 before 0.3.3, from 0.4.0 before 0.4.4, and from 0.5.0 before 0.5.13 is affected, as is the Go module github.com/rancher/steve in the same ranges. By default, steve uses an insecure TLS option that does not validate the certificate of the remote server (CWE-295). A remote attacker with high privileges can perform a man-in-the-middle attack against services that use steve.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

A vulnerability has been identified in Steve where by default it was using an insecure option that did not validate the certificate presented by the remote server while performing a TLS connection. This could allow the execution of a man-in-the-middle (MitM) attack against services using Steve.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00329 26th percentileScored 2026-11-07
Fix Fixed steve (SUSE): 0.2.1, 0.3.3, 0.4.4 +1github.com/rancher/steve (Go): 0.2.1, 0.3.3, 0.4.4 +1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SUSEsteve0.2.0 to before 0.2.1; 0.3.0 to before 0.3.3; 0.4.0 to before 0.4.4; 0.5.0 to before 0.5.130.2.1, 0.3.3, 0.4.4, 0.5.13Patch availableCNA
—github.com/rancher/steve (Go)0.2.0 to before 0.2.10.2.1Patch availableGHSA-95fc-g4gj-mqmx
—github.com/rancher/steve (Go)0.3.0 to before 0.3.30.3.3Patch availableGHSA-95fc-g4gj-mqmx
—github.com/rancher/steve (Go)0.4.0 to before 0.4.40.4.4Patch availableGHSA-95fc-g4gj-mqmx
—github.com/rancher/steve (Go)0.5.0 to before 0.5.130.5.13Patch availableGHSA-95fc-g4gj-mqmx
  • steve VendorSUSE Affected 0.2.0 to before 0.2.1; 0.3.0 to before 0.3.3; 0.4.0 to before 0.4.4; 0.5.0 to before 0.5.13 Fixed in 0.2.1, 0.3.3, 0.4.4, 0.5.13 Patch available CNA
  • github.com/rancher/steve (Go) Vendor— Affected 0.2.0 to before 0.2.1 Fixed in 0.2.1 Patch available GHSA-95fc-g4gj-mqmx
  • github.com/rancher/steve (Go) Vendor— Affected 0.3.0 to before 0.3.3 Fixed in 0.3.3 Patch available GHSA-95fc-g4gj-mqmx
  • github.com/rancher/steve (Go) Vendor— Affected 0.4.0 to before 0.4.4 Fixed in 0.4.4 Patch available GHSA-95fc-g4gj-mqmx
  • github.com/rancher/steve (Go) Vendor— Affected 0.5.0 to before 0.5.13 Fixed in 0.5.13 Patch available GHSA-95fc-g4gj-mqmx

Remediation

Upgrade SUSE steve to 0.2.1, 0.3.3, 0.4.4 or 0.5.13. Upgrade the Go module github.com/rancher/steve to the same fixed versions: 0.2.1, 0.3.3, 0.4.4 or 0.5.13.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA steve (SUSE) Fixed in 0.2.1, 0.3.3, 0.4.4, 0.5.13
  • Fix · GHSA-95fc-g4gj-mqmx github.com/rancher/steve (Go) Fixed in 0.2.1 Advisory →
  • Fix · GHSA-95fc-g4gj-mqmx github.com/rancher/steve (Go) Fixed in 0.3.3 Advisory →
  • Fix · GHSA-95fc-g4gj-mqmx github.com/rancher/steve (Go) Fixed in 0.4.4 Advisory →
  • Fix · GHSA-95fc-g4gj-mqmx github.com/rancher/steve (Go) Fixed in 0.5.13 Advisory →

Timeline

  1. 2026-10-16 Threatist record created from CVE-2023-32198

References

Other 4

  • TI-2016-03560 Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier allows remote… KEVCVSS 3.1CRITICAL 9.8
  • TI-2016-03506 Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary… KEVCVSS 3.1CRITICAL 9.8
  • TI-2016-02888 Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77… KEVCVSS 3.1CRITICAL 9.8
  • TI-2015-04302 Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3)… KEVCVSS 3.1CRITICAL 9.8
  • TI-2015-04301 Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3)… KEVCVSS 3.1CRITICAL 9.8
  • TI-2015-04298 Use-after-free vulnerability in the ByteArray class in the ActionScript 3 (AS3)… KEVCVSS 3.1CRITICAL 9.8
See all 1331 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences