CVE-2025-23390 SUSE CVE debrief

Who should care

Defenders and administrators using Fleet for SSH connections should assess their configurations to ensure secure certificate validation and consider adding server certificates to the `known_hosts` file to prevent potential MitM attacks.

Why it matters

CVE-2025-23390 is a medium-severity vulnerability in Fleet that allows for MitM attacks via SSH connections. Defenders should verify Fleet configurations, especially those using SSH connections, to ensure proper certificate validation and consider adding server certificates to the `known_hosts` file.

• Potential for MitM attacks via SSH connections
• Need for verification of Fleet configurations and certificate validation
• Possible exposure of sensitive data or unauthorized access

Technical summary

The vulnerability in Fleet allows for a man-in-the-middle (MitM) attack when connecting through SSH if the server's certificate isn't set in the `known_hosts` file. This is due to Fleet's default behavior of automatically trusting a remote server's certificate when connecting through SSH if the certificate isn't set in the `known_hosts` file. The vulnerability has a medium severity with a CVSS score of 6.3. Defenders should prioritize verifying Fleet configurations, especially those using SSH connections, to ensure proper certificate validation and consider adding server certificates to the `known_hosts` file.

Defensive priority

Defenders should prioritize verifying Fleet configurations, especially those using SSH connections, to ensure proper certificate validation and consider adding server certificates to the `known_hosts` file.

Recommended defensive actions

• Verify Fleet configurations for proper SSH certificate validation
• Add server certificates to the `known_hosts` file where applicable
• Review and update Fleet installations to ensure secure connections
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD detail page provide information on the vulnerability. However, the scope of affected versions and specific remediation steps require further verification from official sources. The vulnerability has a medium severity with a CVSS score of 6.3. Defenders should verify Fleet configurations, especially those using SSH connections, to ensure proper certificate validation and consider adding server certificates to the `known_hosts` file. The CVE record was published on 2026-10-15T09:17:14.190Z and has not been

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.