CVE-2025-23390Fleet doesn’t validate a server’s certificate when connecting through SSH
Updated under an hour ago ()
Does this affect you?
It affects SUSE fleet. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
A vulnerability has been identified within Fleet where, by default, Fleet will automatically trust a remote server’s certificate when connecting through SSH if the certificate isn’t set in the `known_hosts` file. This could allow the execution of a man-in-the-middle (MitM) attack against Fleet. In case the server that is being connected to has a trusted entry in the known_hosts file, then Fleet will correctly check the authenticity of the presented certificate.
- CVSS
- 6.3 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
- Weakness (CWE)
- CWE-295
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- suse
- NVD analysis
- Awaiting Analysis
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 15, 2026
Affected products
SUSE fleet suse:fleet (from the name) | from 0.9.0-rc.1 before 0.10.12; from 0.11.0 before 0.11.7; from 0.12.0 before 0.12.2 | CNA record |
References
- https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-23390
- https://github.com/rancher/fleet/security/advisories/GHSA-xgpc-q899-67p8
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.