Insecure TLS Certificate Validation in Steve by Rancher
CVE-2023-32198

8HIGH

Key Information:

Vendor

Suse
Status
Steve
Vendor
CVE Published:
15 October 2026

What is CVE-2023-32198?

A vulnerability exists in the Steve tool where it uses an insecure default configuration that fails to validate the certificate from remote servers during TLS connections. This flaw could enable attackers to intercept communications and execute man-in-the-middle (MitM) attacks, posing significant risks to data integrity and confidentiality. Users are urged to review their implementations and apply necessary patches to mitigate this risk.

Affected Version(s)

steve 0.2.0 < 0.2.1

steve 0.3.0 < 0.3.3

steve 0.4.0 < 0.4.4

References

https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32198
https://github.com/rancher/steve/security/advisories/GHSA...

CVSS V3.1

Score:
8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.