Is CVE-2025-23390 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-23390 being exploited in the wild.

How severe is CVE-2025-23390?

Medium severity, with a CVSS score of 6.3, published 15 October 2026.

Which products and versions are affected?

github.com/rancher/fleet (Go) SEMVER:introduced=0.9.0-rc.1,fixed=0.10.12, SEMVER:introduced=0.9.0-rc.1,fixed=0.10.12,introduced=0.11.0,fixed=0.11.7,introduced=0.12.0,fixed=0.12.2; Rancher Fleet 0.10.0 to 0.10.11, 0.11.0 to 0.11.6, 0.12.0 to 0.12.1; v0.9 and earlier.

How is CVE-2025-23390 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-23390?

Check whether you run github.com/rancher/fleet (Go) or Rancher Fleet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-23390: Rancher Fleet insecure SSH certificate validation

CVE-2025-23390 · Severity: medium · CVSS 6.3 · Published 2026-10-15

Rancher Fleet is a software deployment tool that manages applications across Kubernetes clusters. By default, Fleet automatically trusts any remote server's SSH certificate without validation, allowing an attacker on the network to intercept communications and potentially access sensitive data or modify deployments. This vulnerability only occurs when the remote server's certificate is not already recorded in a known_hosts file.

Technologies: github.com/rancher/fleet (Go). Vendors: Go.

Quick answers

Is CVE-2025-23390 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-23390 being exploited in the wild.
How severe is CVE-2025-23390?: Medium severity, with a CVSS score of 6.3, published 15 October 2026.
Which products and versions are affected?: github.com/rancher/fleet (Go) SEMVER:introduced=0.9.0-rc.1,fixed=0.10.12, SEMVER:introduced=0.9.0-rc.1,fixed=0.10.12,introduced=0.11.0,fixed=0.11.7,introduced=0.12.0,fixed=0.12.2; Rancher Fleet 0.10.0 to 0.10.11, 0.11.0 to 0.11.6, 0.12.0 to 0.12.1; v0.9 and earlier.
Is there a fix for CVE-2025-23390?: Yes. github.com/rancher/fleet (Go): upgrade to 0.10.12, 0.12.2 or later. Until then: No workarounds are available; users must upgrade to a patched version as soon as possible. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-23390 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-23390?: Check whether you run github.com/rancher/fleet (Go) or Rancher Fleet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/rancher/fleet (Go): upgrade to 0.10.12, 0.12.2 or later
```
go get github.com/rancher/fleet@v0.12.2
```

No workarounds are available; users must upgrade to a patched version as soon as possible.

Technical details

Fleet fails to validate SSH server certificates when connecting to remote Git repositories if the server's public key is not present in the known_hosts file. An attacker positioned on the network can perform a man-in-the-middle attack to intercept the SSH connection. The fix adds support for populating known_hosts from multiple sources including Kubernetes secrets, environment variables, and a static ConfigMap with common Git provider public keys.

Affected products

Rancher Fleet 0.10.0 to 0.10.11, 0.11.0 to 0.11.6, 0.12.0 to 0.12.1; v0.9 and earlier

Identifiers

CVE-2025-23390
GHSA-xgpc-q899-67p8
GO-2025-3649

Timeline

2025-04-25: disclosed
2026-10-15: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.