{"id":"CVE-2023-32198","sourceIdentifier":"meissner@suse.de","published":"2026-10-15T09:17:13.847","lastModified":"2026-10-16T19:55:59.740","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability has been identified in Steve where by default it was using an insecure option that did not validate the certificate presented by the remote server while performing a TLS connection. This could allow the execution of a man-in-the-middle (MitM) attack against services using Steve."}],"affected":[{"source":"meissner@suse.de","affectedData":[{"vendor":"SUSE","product":"steve","defaultStatus":"unaffected","packageName":"github.com/rancher/steve","versions":[{"version":"0.2.0","lessThan":"0.2.1","versionType":"semver","status":"affected"},{"version":"0.3.0","lessThan":"0.3.3","versionType":"semver","status":"affected"},{"version":"0.4.0","lessThan":"0.4.4","versionType":"semver","status":"affected"},{"version":"0.5.0","lessThan":"0.5.13","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"meissner@suse.de","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","baseScore":8.0,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.3,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-15T19:58:12.590466Z","id":"CVE-2023-32198","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"meissner@suse.de","type":"Secondary","description":[{"lang":"en","value":"CWE-295"}]}],"references":[{"url":"https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32198","source":"meissner@suse.de"},{"url":"https://github.com/rancher/steve/security/advisories/GHSA-95fc-g4gj-mqmx","source":"meissner@suse.de"}]}