{"id":"EUVD-2025-211104","revision":"1e7ac9fc6c904ff48cb36432ae196c9a","records":[{"revision":"1e7ac9fc6c904ff48cb36432ae196c9a","observedAt":"2026-11-03T00:02:19.161+00:00","statement":{"source":"euvd","id":"EUVD-2025-211104","aliases":["CVE-2025-23390","GHSA-xgpc-q899-67p8"],"title":"A vulnerability has been identified within Fleet where, by default, Fleet will automatically trust a remote server’s certificate when connecting through SSH if the certificate isn’t set in the `known_hosts` file. This could allow the execut…","description":"A vulnerability has been identified within Fleet where, by default, Fleet will automatically trust a remote server’s certificate when connecting through SSH if the certificate isn’t set in the `known_hosts` file. This could allow the execution of a man-in-the-middle (MitM) attack against Fleet. In case the server that is being connected to has a trusted entry in the known_hosts file, then Fleet will correctly check the authenticity of the presented certificate.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","score":6.3,"severity":null}],"references":["https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-23390","https://github.com/rancher/fleet/security/advisories/GHSA-xgpc-q899-67p8"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-211104","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Oct 15, 2026, 8:16:46 AM","dateUpdated":"Oct 15, 2026, 2:21:33 PM"},"relatedAdvisories":[{"id":"openSUSE-SU-2025:15059-1","title":"govulncheck-vulndb-0.0.20250506T153719-1.1 on GA media","vulnerabilityIds":["CVE-2019-11243","CVE-2023-32198","CVE-2024-22031","CVE-2025-23390","CVE-2025-32777","CVE-2025-3879","CVE-2025-4166","CVE-2025-4210","CVE-2025-46327","CVE-2025-46342","CVE-2025-46569","CVE-2025-46599"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2025-211104","identifiers":["EUVD-2025-211104","CVE-2025-23390","GHSA-xgpc-q899-67p8"]},"retained":false,"historicalAffected":[]}],"coverage":[]}