CVE-2025-23390

6.3 Moyenne

Publiée le 15/10/2026 à 11:17 · Modifiée le 20/10/2026 à 00:10 · En attente d'analyse NVD · Source : meissner@suse.de

Description

A vulnerability has been identified within Fleet where, by default, Fleet will automatically trust a remote server’s certificate when connecting through SSH if the certificate isn’t set in the `known_hosts` file. This could allow the execution of a man-in-the-middle (MitM) attack against Fleet. In case the server that is being connected to has a trusted entry in the known_hosts file, then Fleet will correctly check the authenticity of the presented certificate.

Traduire en français

Produits concernés

SUSE fleet

Scores CVSS

Version	Score	Source	Vecteur
3.1	6.3 Moyenne	meissner@suse.de	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L`

Faiblesses (CWE)

CWE-295

Références

https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-23390
https://github.com/rancher/fleet/security/advisories/GHSA-xgpc-q899-67p8

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories