CVE-2023-32198: suse steve Improper Certificate Validation
CVSS: 8.0v3.1HighAwaiting analysis
AliasesCGA-2p4p-pvvh-gw4rCGA-44c7-22j7-hqqfCGA-fhj8-4x53-v7qhCGA-g58j-67qx-wc29CGA-grj9-v867-f7wrCGA-h5jg-835q-65fxCGA-mmcx-x9cf-8p2wCGA-qqgc-m4j4-j9m6GHSA-95fc-g4gj-mqmxGO-2025-3648CGA-3ccw-xjf3-w7c3CGA-3fqj-v2x4-hfqjCGA-3jp8-mgxm-jxpcCGA-4rv6-rrh7-3fwrCGA-52cv-p686-qfr4CGA-52g5-prpc-76rqCGA-54cp-3rxm-5m6gCGA-6p5x-v34m-p75qCGA-7gjh-c89c-h8j4CGA-7x99-363j-rq5fCGA-fhxc-6qg3-4f5hCGA-hfvg-vmvv-6gmfCGA-j3c3-23gc-2mhvCGA-j7fc-vfhm-9v2cCGA-j855-r77m-3mqxCGA-p692-p6vp-vw3hCGA-ppv4-m422-283rCGA-q3q3-jj3w-cm8fCGA-rh99-qv33-c3wrCGA-rqcx-rpc8-x68qCGA-vx9g-6g5j-7mjrCGA-xm6w-p545-qc3f
Published 15-10-2026Last modified 15-10-2026
Vulnerability summary
CVE-2023-32198 is a high (CVSS 8.0) Improper Certificate Validation vulnerability in suse steve. EPSS estimates a 0.33% chance of exploitation in the next 30 days, higher than 24.4% of scored vulnerabilities.
CVSS score
8.0/10
010
High · v3.1 (CVE.org)EPSS score
0.33%
0%100%
Low · Change unavailableKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 1 · Related 2Timeline
- 15-10-2026PublishedVulnerability first disclosed.
- 15-10-2026Last modifiedVulnerability information updated.
Description
A vulnerability has been identified in Steve where by default it was using an insecure option that did not validate the certificate presented by the remote server while performing a TLS connection. This could allow the execution of a man-in-the-middle (MitM) attack against services using Steve.
CVSS metrics
4 scores · 4 sources · 1 versionHigh 8.0Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:HSourcesAll 4 agree
- OSV · GoEcosystem advisory · calculated8.0HighCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated8.0HighCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
- NVDNIST8.0HighCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
EPSS trend
Probability
0.33%
Chance of exploitation in the next 30 days
Percentile
24%
Versus all other CVEs
30-day change
Change unavailable
Change unavailable
15-10-202618-10-2026
EPSS score0.33%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard15 products
- harvester< 1.8.1-r1
- harvester-fips< 1.8.1-r0
- harvester-fips-webhook< 1.8.1-r0
- harvester-webhook< 1.8.1-r1
- rancher-2.10< 2.10.12-r1
Wolfi4 products
- rancher-2.13All versions (No fix recorded)
- rancher-2.14All versions (No fix recorded)
- rancher-agent-2.13All versions (No fix recorded)
- rancher-agent-2.14All versions (No fix recorded)
Github.com/rancher1 product
- steve≥ 0.2.0, < 0.2.1 | ≥ 0.3.0, < 0.3.3 | ≥ 0.4.0, < 0.4.4 | All versions (No fix recorded) | ≥ 0.5.0, < 0.5.13
Suse1 product
- steve≥ 0.2.0, < 0.2.1 | ≥ 0.3.0, < 0.3.3 | ≥ 0.4.0, < 0.4.4 | ≥ 0.5.0, < 0.5.13
4 vendors · 21 products
References
4 links- github.com/rancher/stevePACKAGE