Executive brief
Fleet doesn’t validate a server’s certificate when connecting through SSH in github.com/rancher/fleet
Affected products
- Go github.com/rancher/fleet
Junglewise Threat Intelligence
CVE-2025-23390: GO-2025-3649 - Fleet doesn’t validate a server’s certificate when connecting through SSH in github.com/rancher/fleet
CVE-2025-23390 · Severity: low · CVSS 3.1 · Published 2025-05-05
Technologies: github.com/rancher/fleet (Go). Vendors: Go.
Related threats
- SUSE Rancher Fleet Pod Security Standards bypass in agent-side deployer
- SUSE Rancher Fleet webhook request forgery via regex injection
- SUSE Rancher Fleet credential leak via unvalidated Helm repository URL
- SUSE Rancher Fleet improper validation in Helm Deployer
- Rancher Fleet Helm impersonation bypass in RESTClientGetter