# CVE-2025-23390: Rancher Fleet insecure SSH certificate validation

Source: https://junglewise.ai/threats/cve-2025-23390-fleet-doesn-t-validate-a-server-s-certificate-when-connecting  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-15. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2025-23390 · Severity: medium · CVSS 6.3 · Published 2026-10-15

Rancher Fleet is a software deployment tool that manages applications across Kubernetes clusters. By default, Fleet automatically trusts any remote server's SSH certificate without validation, allowing an attacker on the network to intercept communications and potentially access sensitive data or modify deployments. This vulnerability only occurs when the remote server's certificate is not already recorded in a known_hosts file.

Technologies: [github.com/rancher/fleet (Go)](https://junglewise.ai/threats/technologies/github-com-rancher-fleet). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2025-23390 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-23390 being exploited in the wild.

**How severe is CVE-2025-23390?** Medium severity, with a CVSS score of 6.3, published 15 October 2026.

**Which products and versions are affected?** github.com/rancher/fleet (Go) SEMVER:introduced=0.9.0-rc.1,fixed=0.10.12, SEMVER:introduced=0.9.0-rc.1,fixed=0.10.12,introduced=0.11.0,fixed=0.11.7,introduced=0.12.0,fixed=0.12.2; Rancher Fleet 0.10.0 to 0.10.11, 0.11.0 to 0.11.6, 0.12.0 to 0.12.1; v0.9 and earlier.

**Is there a fix for CVE-2025-23390?** Yes. github.com/rancher/fleet (Go): upgrade to 0.10.12, 0.12.2 or later. Until then: No workarounds are available; users must upgrade to a patched version as soon as possible. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-23390 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-23390?** Check whether you run github.com/rancher/fleet (Go) or Rancher Fleet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/rancher/fleet (Go): upgrade to 0.10.12, 0.12.2 or later

  ```sh
  go get github.com/rancher/fleet@v0.12.2
  ```


No workarounds are available; users must upgrade to a patched version as soon as possible.

## Technical details

Fleet fails to validate SSH server certificates when connecting to remote Git repositories if the server's public key is not present in the known_hosts file. An attacker positioned on the network can perform a man-in-the-middle attack to intercept the SSH connection. The fix adds support for populating known_hosts from multiple sources including Kubernetes secrets, environment variables, and a static ConfigMap with common Git provider public keys.

## Affected products

- Rancher Fleet 0.10.0 to 0.10.11, 0.11.0 to 0.11.6, 0.12.0 to 0.12.1; v0.9 and earlier

## Identifiers

- CVE-2025-23390
- GHSA-xgpc-q899-67p8
- GO-2025-3649

## Timeline

- 2025-04-25: disclosed
- 2026-10-15: advisory

## References

- [https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-23390](https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-23390)
- [https://github.com/rancher/fleet/security/advisories/GHSA-xgpc-q899-67p8](https://github.com/rancher/fleet/security/advisories/GHSA-xgpc-q899-67p8)

## Related threats

- [SUSE Rancher Fleet Pod Security Standards bypass in agent-side deployer](https://junglewise.ai/threats/cve-2026-44938-suse-rancher-fleet-pod-security-standards-bypass-in-agent-side)
- [SUSE Rancher Fleet webhook request forgery via regex injection](https://junglewise.ai/threats/cve-2026-44937-suse-rancher-fleet-webhook-request-forgery-via-regex-injection)
- [SUSE Rancher Fleet credential leak via unvalidated Helm repository URL](https://junglewise.ai/threats/cve-2026-44936-suse-rancher-fleet-credential-leak-via-unvalidated-helm)
- [SUSE Rancher Fleet improper validation in Helm Deployer](https://junglewise.ai/threats/cve-2026-44935-suse-rancher-fleet-improper-validation-in-helm-deployer)
- [Rancher Fleet Helm impersonation bypass in RESTClientGetter](https://junglewise.ai/threats/cve-2026-41050-rancher-fleet-helm-impersonation-bypass-in-restclientgetter)