Man-in-the-Middle Vulnerability in Fleet by Rancher
CVE-2025-23390

6.3MEDIUM

Key Information:

Vendor

Suse
Status
Fleet
Vendor
CVE Published:
15 October 2026

What is CVE-2025-23390?

A security vulnerability has been identified within Rancher's Fleet that poses a risk when connecting to remote servers via SSH. If a remote server’s certificate is not listed in the 'known_hosts' file, Fleet will trust the certificate by default, which creates an opportunity for attackers to carry out a man-in-the-middle (MitM) attack. This issue may allow unauthorized entities to intercept or manipulate sensitive data during these SSH sessions. Only when a server's certificate is recognized in the known_hosts file does Fleet perform the appropriate verification, ensuring the authenticity of the connection.

Affected Version(s)

fleet 0.9.0-rc.1 < 0.10.12

fleet 0.11.0 < 0.11.7

fleet 0.12.0 < 0.12.2

References

https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-23390
https://github.com/rancher/fleet/security/advisories/GHSA...

CVSS V3.1

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.