Fleet doesn’t validate a server’s certificate when connecting through SSH in github.com/rancher/fleet
Fleet doesn’t validate a server’s certificate when connecting through SSH in github.com/rancher/fleet
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-23390US | — | — | ||
A vulnerability has been identified within Fleet where, by default, Fleet will automatically trust a remote server’s certificate when connecting through SSH if the certificate isn’… | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/rancher/fleet/pull/3571FIX
- https://github.com/rancher/fleet/pull/3572FIX
- https://github.com/rancher/fleet/pull/3573FIX
- https://github.com/rancher/fleet/releases/tag/v0.10.12WEB
- https://github.com/rancher/fleet/releases/tag/v0.11.7WEB
- https://github.com/rancher/fleet/releases/tag/v0.12.2WEB
- https://github.com/rancher/fleet/security/advisories/GHSA-xgpc-q899-67p8ADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan