CVE-2025-23390

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-23390
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-23390.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-23390
Aliases
Downstream
Related
Published
2026-10-15T08:16:46Z
Modified
2026-10-16T02:46:35Z
Severity
  • 6.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
Summary
Fleet doesn’t validate a server’s certificate when connecting through SSH
Details

A vulnerability has been identified within Fleet where, by default, Fleet will automatically trust a remote server’s certificate when connecting through SSH if the certificate isn’t set in the known_hosts file. This could allow the execution of a man-in-the-middle (MitM) attack against Fleet. In case the server that is being connected to has a trusted entry in the known_hosts file, then Fleet will correctly check the authenticity of the presented certificate.

Database specific 
{
    "cna_assigner":  "suse",
    "cwe_ids":  [
        "CWE-295"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/23xxx/CVE-2025-23390.json"
}
References

Affected packages

Git / github.com/rancher/fleet

Affected ranges

Type
GIT
Repo
https://github.com/rancher/fleet
Events
Introduced
0d26f206b3c521fdb78218285ffb69a91c6e5c81
Fixed
1dd9dd2074db8f1f9478b9b2fb046eba0a2539e4
Introduced
3e91ed3fb600e6499107751f7c3c0ab255f09640
Fixed
4809cf03c8926d834067bf1111ea24df6b875c32
Introduced
3d1fa6c06ff392c9fa66ca2f46831e2dae23bc16
Fixed
fcb09948fb937f043ab421b2b7ef03d7cbcce02b
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0.9.0-rc.1"
        },
        {
            "fixed":  "0.10.12"
        },
        {
            "introduced":  "0.11.0"
        },
        {
            "fixed":  "0.11.7"
        },
        {
            "introduced":  "0.12.0"
        },
        {
            "fixed":  "0.12.2"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

pkg/apis/v0.*
pkg/apis/v0.10.0-rc.13
pkg/apis/v0.10.0-rc.14
pkg/apis/v0.10.0-rc.15
pkg/apis/v0.10.0-rc.16
pkg/apis/v0.10.0-rc.19
pkg/apis/v0.10.0-rc.20
pkg/apis/v0.10.0-rc.21
pkg/apis/v0.10.0-rc.4
pkg/apis/v0.10.11
pkg/apis/v0.10.11-beta.1
pkg/apis/v0.10.11-rc.1
pkg/apis/v0.10.8
pkg/apis/v0.10.8-beta.1
pkg/apis/v0.11.0
pkg/apis/v0.11.0-rc.4
pkg/apis/v0.11.3
pkg/apis/v0.11.3-beta.1
pkg/apis/v0.11.6
pkg/apis/v0.11.6-beta.1
pkg/apis/v0.11.6-rc.1
pkg/apis/v0.12.0
pkg/apis/v0.12.0-rc.5
pkg/apis/v0.12.1
pkg/apis/v0.12.1-beta.1
pkg/apis/v0.12.1-rc.1
v0.*
v0.10.0-rc.1
v0.10.0-rc.10
v0.10.0-rc.11
v0.10.0-rc.12
v0.10.0-rc.13
v0.10.0-rc.14
v0.10.0-rc.15
v0.10.0-rc.16
v0.10.0-rc.17
v0.10.0-rc.18
v0.10.0-rc.19
v0.10.0-rc.2
v0.10.0-rc.20
v0.10.0-rc.21
v0.10.0-rc.3
v0.10.0-rc.4
v0.10.0-rc.5
v0.10.0-rc.6
v0.10.0-rc.7
v0.10.0-rc.8
v0.10.0-rc.9
v0.10.1
v0.10.1-rc.3
v0.10.10
v0.10.11
v0.10.11-beta.1
v0.10.11-beta.2
v0.10.11-rc.1
v0.10.2
v0.10.2-rc.1
v0.10.2-rc.2
v0.10.2-rc.3
v0.10.2-rc.4
v0.10.3-rc.1
v0.10.4
v0.10.4-rc.1
v0.10.4-rc.2
v0.10.4-rc.3
v0.10.4-rc.4
v0.10.5
v0.10.5-rc.1
v0.10.5-rc.2
v0.10.5-rc.3
v0.10.6
v0.10.6-rc.1
v0.10.7
v0.10.7-rc.1
v0.10.7-rc.2
v0.10.8
v0.10.8-beta.1
v0.10.8-rc.1
v0.10.8-rc.2
v0.10.9
v0.10.9-rc.1
v0.10.9-rc.2
v0.11.0
v0.11.0-rc.4
v0.11.1
v0.11.1-rc.1
v0.11.1-rc.2
v0.11.1-rc.3
v0.11.2
v0.11.2-rc.1
v0.11.2-rc.2
v0.11.3
v0.11.3-beta.1
v0.11.3-rc.1
v0.11.3-rc.2
v0.11.4
v0.11.4-rc.1
v0.11.4-rc.2
v0.11.5
v0.11.6
v0.11.6-beta.1
v0.11.6-beta.2
v0.11.6-rc.1
v0.11.6-rc.2
v0.12.0
v0.12.0-rc.5
v0.12.1
v0.12.1-beta.1
v0.12.1-beta.2
v0.12.1-rc.1
v0.9.0-rc.1
v0.9.0-rc.2
v0.9.0-rc.3
v0.9.0-rc.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-23390.json"