Improper certificate validation in Fleet SSH connections
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-295.
Summary
SUSE fleet and the Go module github.com/rancher/fleet are affected from 0.9.0-rc.1 before 0.10.12, from 0.11.0 before 0.11.7, and from 0.12.0 before 0.12.2. By default, Fleet trusts a remote server's certificate when connecting through SSH if the certificate is not set in the known_hosts file, which is improper certificate validation (CWE-295). A network attacker with low privileges can use this to carry out a man in the middle attack against Fleet.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
A vulnerability has been identified within Fleet where, by default, Fleet will automatically trust a remote server’s certificate when connecting through SSH if the certificate isn’t set in the `known_hosts` file. This could allow the execution of a man-in-the-middle (MitM) attack against Fleet. In case the server that is being connected to has a trusted entry in the known_hosts file, then Fleet will correctly check the authenticity of the presented certificate.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| SUSE | fleet | 0.9.0-rc.1 to before 0.10.12; 0.11.0 to before 0.11.7; 0.12.0 to before 0.12.2 | 0.10.12, 0.11.7, 0.12.2 | Patch available | CNA |
| — | github.com/rancher/fleet (Go) | 0.9.0-rc.1 to before 0.10.12 | 0.10.12 | Patch available | GHSA-xgpc-q899-67p8 |
| — | github.com/rancher/fleet (Go) | 0.11.0 to before 0.11.7 | 0.11.7 | Patch available | GHSA-xgpc-q899-67p8 |
| — | github.com/rancher/fleet (Go) | 0.12.0 to before 0.12.2 | 0.12.2 | Patch available | GHSA-xgpc-q899-67p8 |
- fleet VendorSUSE Affected 0.9.0-rc.1 to before 0.10.12; 0.11.0 to before 0.11.7; 0.12.0 to before 0.12.2 Fixed in 0.10.12, 0.11.7, 0.12.2 Patch available CNA
- github.com/rancher/fleet (Go) Vendor— Affected 0.9.0-rc.1 to before 0.10.12 Fixed in 0.10.12 Patch available GHSA-xgpc-q899-67p8
- github.com/rancher/fleet (Go) Vendor— Affected 0.11.0 to before 0.11.7 Fixed in 0.11.7 Patch available GHSA-xgpc-q899-67p8
- github.com/rancher/fleet (Go) Vendor— Affected 0.12.0 to before 0.12.2 Fixed in 0.12.2 Patch available GHSA-xgpc-q899-67p8
Remediation
Upgrade SUSE fleet to 0.10.12, 0.11.7 or 0.12.2 according to its release line, and upgrade github.com/rancher/fleet to the matching fixed version.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · CNA fleet (SUSE) Fixed in 0.10.12, 0.11.7, 0.12.2
- Fix · GHSA-xgpc-q899-67p8 github.com/rancher/fleet (Go) Fixed in 0.10.12 Advisory →
- Fix · GHSA-xgpc-q899-67p8 github.com/rancher/fleet (Go) Fixed in 0.11.7 Advisory →
- Fix · GHSA-xgpc-q899-67p8 github.com/rancher/fleet (Go) Fixed in 0.12.2 Advisory →
Timeline
- 2026-10-16 Threatist record created from CVE-2025-23390
References
Other 10
- https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-23390
- https://github.com/rancher/fleet/security/advisories/GHSA-xgpc-q899-67p8
- https://github.com/rancher/fleet/pull/3571
- https://github.com/rancher/fleet/pull/3572
- https://github.com/rancher/fleet/pull/3573
- https://github.com/rancher/fleet
- https://github.com/rancher/fleet/releases/tag/v0.10.12
- https://github.com/rancher/fleet/releases/tag/v0.11.7
- https://github.com/rancher/fleet/releases/tag/v0.12.2
- https://pkg.go.dev/vuln/GO-2025-3649
More SUSE vulnerabilities
- TI-2016-03560 Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier allows remote… KEVCVSS 3.1CRITICAL 9.8
- TI-2016-03506 Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary… KEVCVSS 3.1CRITICAL 9.8
- TI-2016-02888 Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77… KEVCVSS 3.1CRITICAL 9.8
- TI-2015-04302 Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3)… KEVCVSS 3.1CRITICAL 9.8
- TI-2015-04301 Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3)… KEVCVSS 3.1CRITICAL 9.8
- TI-2015-04298 Use-after-free vulnerability in the ByteArray class in the ActionScript 3 (AS3)… KEVCVSS 3.1CRITICAL 9.8
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences