---
id: CVE-2025-23390
title: >-
  A vulnerability has been identified within Fleet where, by default, Fleet will
  automatically trust a remote server’s certificate when connecting through SSH
  if the certificate isn’t set in the `known_hosts` file
summary: >-
  A vulnerability has been identified within Fleet where, by default, Fleet will
  automatically trust a remote server’s certificate when connecting through SSH
  if the certificate isn’t set in the `known_hosts` file. This could allow the
  exe…
severity: medium
cvss: 6.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L'
cwe:
  - CWE-295
vendor: SUSE
product: github.com/rancher/fleet
affected:
  - github.com/rancher/fleet >= 0.9.0-rc.1 < 0.10.12
  - github.com/rancher/fleet >= 0.11.0 < 0.11.7
  - github.com/rancher/fleet >= 0.12.0 < 0.12.2
published: '2026-10-15'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T09:17:14.190'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-23390'
references:
  - url: 'https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-23390'
    label: meissner@suse.de
  - url: 'https://github.com/rancher/fleet/security/advisories/GHSA-xgpc-q899-67p8'
    label: meissner@suse.de
tags:
  - nvd
  - cve.org
ingestedAt: '2026-10-15T08:58:33.101Z'
---

## Overview

A vulnerability has been identified within Fleet where, by default, Fleet will automatically trust a remote server’s certificate when connecting through SSH if the certificate isn’t set in the `known_hosts` file. This could allow the execution of a man-in-the-middle (MitM) attack against Fleet. In case the server that is being connected to has a trusted entry in the known_hosts file, then Fleet will correctly check the authenticity of the presented certificate.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.