medium6.3
CVE-2025-23390
A vulnerability has been identified within Fleet where, by default, Fleet will automatically trust a remote server’s certificate when connecting through SSH if…
Impact
A vulnerability has been identified within Fleet where, by default, Fleet will automatically trust a remote server’s certificate when connecting through SSH if the certificate isn’t set in the `known_hosts` file. This could allow the execution of a man-in-the-middle (MitM) attack against Fleet. In case the server that is being connected to has a trusted entry in the known_hosts file, then Fleet will correctly check the authenticity of the presented certificate.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/rancher/fleet | >= 0.9.0-rc.1, < 0.10.12 | 0.10.12 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-23390
- https://github.com/rancher/fleet/security/advisories/GHSA-xgpc-q899-67p8
- https://github.com/advisories/GHSA-xgpc-q899-67p8
- https://github.com/rancher/fleet/pull/3571
- https://github.com/rancher/fleet/pull/3572
- https://github.com/rancher/fleet/pull/3573
- https://github.com/rancher/fleet/releases/tag/v0.10.12
- https://github.com/rancher/fleet/releases/tag/v0.11.7
- https://github.com/rancher/fleet/releases/tag/v0.12.2
- https://pkg.go.dev/vuln/GO-2025-3649