CVE-2023-32198
A vulnerability has been identified in Steve where by default it was using an insecure option that did not validate the certificate presented by the remote server while performing a TLS connection. This could allow the execution of a man-in-the-middle (MitM) attack against services using Steve.
- CVSS 3.1
- 8.0
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H - EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 25% of CVEs (scores of 2026-10-25)
- CWE
- CWE-295
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-95fc-g4gj-mqmx | Go | github.com/rancher/steve | >=0.2.0 <0.2.1 | 0.2.1 |
| GHSA-95fc-g4gj-mqmx | Go | github.com/rancher/steve | >=0.3.0 <0.3.3 | 0.3.3 |
| GHSA-95fc-g4gj-mqmx | Go | github.com/rancher/steve | >=0.4.0 <0.4.4 | 0.4.4 |
| GHSA-95fc-g4gj-mqmx | Go | github.com/rancher/steve | >=0.5.0 <0.5.13 | 0.5.13 |
| GO-2025-3648 | Go | github.com/rancher/steve | all versions | no fix published |
| GO-2025-3648 | Go | github.com/rancher/steve | >=0.2.0 <0.2.1 >=0.4.0 <0.4.4 >=0.5.0 <0.5.13 | 0.2.1, 0.4.4, 0.5.13 |