Answer in brief
CVE-2025-23390 records a Medium severity (CVSS 6.3) vulnerability in Fleet doesn’t validate a server’s certificate when connecting through SSH. The current sources do not mark it as known exploited. The current feed maps SUSE/fleet (generic), github.com/rancher/fleet (go), github.com/rancher/fleet (go), github.com/rancher/fleet (go). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 6.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps SUSE/fleet (generic), github.com/rancher/fleet (go), github.com/rancher/fleet (go), github.com/rancher/fleet (go). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| SUSE/fleetgeneric | >=0.9.0-rc.1 <0.10.12 || >=0.11.0 <0.11.7 || >=0.12.0 <0.12.2 | 0.10.12, 0.11.7, 0.12.2 |
| github.com/rancher/fleetgo | >=0.9.0-rc.1 <0.10.12 | 0.10.12 |
| github.com/rancher/fleetgo | >=0.11.0 <0.11.7 | 0.11.7 |
| github.com/rancher/fleetgo | >=0.12.0 <0.12.2 | 0.12.2 |
Published upstream
Oct 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 7, 2026
A vulnerability has been identified within Fleet where, by default, Fleet will automatically trust a remote server’s certificate when connecting through SSH if the certificate isn’t set in the `known_hosts` file. This could allow the execution of a man-in-the-middle (MitM) attack against Fleet. In case the server that is being connected to has a trusted entry in the known_hosts file, then Fleet will correctly check the authenticity of the presented certificate.
Quoted source text, attributed separately from HOL analysis.