CVE-2025-71261 - Vulnerability Details - OpenCVE

An attacker with network-level access between the SUSE Virtualization and Rancher Manager in SUSE Harvester before 1.8.0 could interfere with the TLS handshake and abuse it to bypass TLS as a security control.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Suse	Harvester

No data.

No data.

References

Link	Providers
https://github.com/harvester/harvester/security/advisories/GHSA-pgh9-mpwc-8jjf

History

Tue, 16 Jun 2026 18:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 16 Jun 2026 17:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Suse Suse harvester
Vendors & Products		Suse Suse harvester

Tue, 16 Jun 2026 16:45:00 +0000

Type	Values Removed	Values Added
Description		An attacker with network-level access between the SUSE Virtualization and Rancher Manager in SUSE Harvester before 1.8.0 could interfere with the TLS handshake and abuse it to bypass TLS as a security control.
Title		Harvester's SUSE Virtualization Registration Client Vulnerable to MITM and DOS
Weaknesses		CWE-295
References		https://github.com/harvester/harvester/security/advisories/GHSA-pgh9-mpwc-8jjf
Metrics		cvssV3_1 `{'score': 8.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H'}`

MITRE

Status: PUBLISHED

Assigner: suse

Published: 2026-06-16T15:42:32.446Z

Updated: 2026-06-16T17:52:30.747Z

Reserved: 2026-03-03T12:54:04.008Z

Link: CVE-2025-71261

Vulnrichment

Updated: 2026-06-16T17:52:26.836Z

NVD

Status : Awaiting Analysis

Published: 2026-06-16T17:16:30.193

Modified: 2026-06-16T17:37:16.933

Link: CVE-2025-71261

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-71261", "assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "state": "PUBLISHED", "assignerShortName": "suse", "dateReserved": "2026-03-03T12:54:04.008Z", "datePublished": "2026-06-16T15:42:32.446Z", "dateUpdated": "2026-06-16T17:52:30.747Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "shortName": "suse", "dateUpdated": "2026-06-16T15:42:32.446Z"}, "title": "Harvester's SUSE Virtualization Registration Client Vulnerable to MITM and DOS", "datePublic": "2026-06-16T15:38:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-295", "description": "CWE-295", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-94", "descriptions": [{"lang": "en", "value": "CAPEC-94 Adversary in the Middle (AiTM)"}]}], "affected": [{"vendor": "SUSE", "product": "Harvester", "packageName": "Harvester", "repo": "https://github.com/harvester/harvester/", "modules": ["SUSE Virtualization (Harvester) Rancher integration mechanism"], "versions": [{"status": "affected", "version": "0", "lessThan": "1.8", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "An attacker with network-level access between the SUSE Virtualization \nand Rancher Manager in SUSE Harvester before 1.8.0 could interfere with the TLS handshake and abuse it \nto bypass TLS as a security control.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "An attacker with network-level access between the SUSE Virtualization \nand Rancher Manager in SUSE Harvester before 1.8.0 could interfere with the TLS handshake and abuse it \nto bypass TLS as a security control."}]}], "references": [{"url": "https://github.com/harvester/harvester/security/advisories/GHSA-pgh9-mpwc-8jjf", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 8.6, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.2"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-16T17:52:23.783748Z", "id": "CVE-2025-71261", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-16T17:52:30.747Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-71261", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-16T17:52:23.783748Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-16T17:52:26.836Z"}}], "cna": {"title": "Harvester's SUSE Virtualization Registration Client Vulnerable to MITM and DOS", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-94", "descriptions": [{"lang": "en", "value": "CAPEC-94 Adversary in the Middle (AiTM)"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/harvester/harvester/", "vendor": "SUSE", "modules": ["SUSE Virtualization (Harvester) Rancher integration mechanism"], "product": "Harvester", "versions": [{"status": "affected", "version": "0", "lessThan": "1.8", "versionType": "custom"}], "packageName": "Harvester", "defaultStatus": "unaffected"}], "datePublic": "2026-06-16T15:38:00.000Z", "references": [{"url": "https://github.com/harvester/harvester/security/advisories/GHSA-pgh9-mpwc-8jjf", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 1.0.2"}, "descriptions": [{"lang": "en", "value": "An attacker with network-level access between the SUSE Virtualization \nand Rancher Manager in SUSE Harvester before 1.8.0 could interfere with the TLS handshake and abuse it \nto bypass TLS as a security control.", "supportingMedia": [{"type": "text/html", "value": "An attacker with network-level access between the SUSE Virtualization \nand Rancher Manager in SUSE Harvester before 1.8.0 could interfere with the TLS handshake and abuse it \nto bypass TLS as a security control.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-295", "description": "CWE-295"}]}], "providerMetadata": {"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "shortName": "suse", "dateUpdated": "2026-06-16T15:42:32.446Z"}}}, "cveMetadata": {"cveId": "CVE-2025-71261", "state": "PUBLISHED", "dateUpdated": "2026-06-16T17:52:30.747Z", "dateReserved": "2026-03-03T12:54:04.008Z", "assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "datePublished": "2026-06-16T15:42:32.446Z", "assignerShortName": "suse"}, "dataVersion": "5.2"}