CVE-2023-32198
Received Received - Intake

Insecure TLS Certificate Validation in Steve Allows MitM Attacks

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: SUSE

Description
A vulnerability has been identified in Steve where by default it was using an insecure option that did not validate the certificate presented by the remote server while performing a TLS connection. This could allow the execution of a man-in-the-middle (MitM) attack against services using Steve.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-15
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2023-32198
EUVD
EUVD-2023-60719

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
SUSE steve 0.2.0
SUSE steve 0.3.0
SUSE steve 0.4.0
SUSE steve 0.5.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-295 The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves Steve, a Rancher component, failing to validate server certificates during TLS connections by default. This allows man-in-the-middle attacks where attackers can intercept or manipulate communications between Steve and remote servers.

Detection Guidance

To detect this vulnerability, check if Steve is running an affected version (<0.2.1, <0.3.3, <0.4.4, <0.5.13) and if certificate verification is disabled. Inspect Steve's configuration for the `ui-offline-preferred` setting set to `remote` and verify if TLS connections are not validating certificates.

Impact Analysis

Attackers with service creation permissions in Rancher’s local cluster could hijack the UI, display malicious content, and steal sensitive information. This is especially risky if the ui-offline-preferred setting is set to remote.

Mitigation Strategies

Upgrade Steve to a patched version (0.2.1, 0.3.3, 0.4.4, or 0.5.13). If upgrading is not possible, ensure Steve only connects to trusted servers and manually enforce certificate verification in TLS connections.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2023-32198. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart