Rancher Fleet EUVD-2025-211104

Exploitation requires three concrete conditions tied to Fleet's SSH host-key handling: (1) the attacker must occupy an on-path/adversary-in-the-middle network position between Fleet and the target git or SSH server; (2) the target server must NOT have a trusted entry in the known_hosts file - Fleet's default trust-on-first-use behavior auto-accepts any presented key only for unpinned hosts; and (3) a Fleet component must initiate the SSH connection (the git latest-commit fetcher, git cloner, or fleet apply reading FLEET_KNOWN_HOSTS). The exploitation window is effectively neutralized once a correct known_hosts entry exists (via a GitRepo clientSecretName secret, a gitcredential secret, or Fleet's new known-hosts config map for GitHub/GitLab/Bitbucket/Azure DevOps), since Fleet then correctly validates the key. Limiting factors: the MitM positioning requirement, the dependency on default/unconfigured known_hosts state, and that successful interception yields only low-level impact to each of C/I/A.

This is a genuine but moderate-priority issue, not a drop-everything emergency. The official CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L = 6.3 Medium) describes a network-reachable flaw with low attacker privileges and low impact to confidentiality, integrity and availability. No EPSS score, no CISA KEV listing, and no public exploit code are present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active or widespread exploitation. The signals are internally consistent (all point to medium severity) with one caveat worth flagging: the official vector uses AC:L, but this is a man-in-the-middle / adversary-in-the-middle weakness (CWE-295), and CVSS guidance explicitly treats MitM as AC:H because the attacker must inject themselves into the network path - a condition beyond their control. The AC:L rating therefore likely overstates practical ease of exploitation. Realistic risk is bounded by the precondition that an attacker must already hold an on-path network position and that the target host must be absent from known_hosts; where both hold, trust-on-first-use lets a MitM succeed. Treat as a scheduled-patch item for Rancher/Fleet operators rather than an urgent remote-code-execution class bug.

An attacker positioned on the network path between Fleet and a git/SSH server (e.g. via ARP spoofing, rogue gateway, or compromised intermediate hop) waits for Fleet to make its first SSH connection to a host not yet pinned in known_hosts. Because Fleet trusts the presented key by default, the attacker transparently intercepts and proxies the session, enabling interception or tampering of the GitOps data flow. No public proof-of-concept is identified in the provided data; the attack relies on standard MitM tooling rather than a dedicated exploit.