The vulnerability stems from a default configuration in Fleet that automatically trusts a remote server’s SSH certificate when it is not present in the known_hosts file. This oversight allows an attacker who can position themselves as the remote host to insert a forged certificate, leading to a man‑in‑the‑middle attack. The impact is that an attacker could intercept, modify, or eavesdrop on communication between Fleet and the remote server, potentially compromising confidential data or executing unauthorized commands.

The affected product is SUSE Fleet. No specific version range is provided in the CNA data, so all currently supported Fleet releases are potentially affected until a patch is applied.

The CVSS score of 6.3 indicates moderate severity, while the EPSS score of <1% suggests a low likelihood of immediate exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack vector requires an attacker to control the server to which Fleet connects over SSH; with no known_hosts entry, Fleet accepts any presented certificate, enabling the attacker to perform a man‑in‑the‑middle attack without needing additional credentials.