{"id":"CVE-2025-71261","title":"An attacker with network-level access between the SUSE Virtualization \nand Rancher Manager in SUSE Harvester before 1.8.0 could interfere with the TLS handshake and abuse it \nto bypass TLS as a security control.","summary":"An attacker with network-level access between the SUSE Virtualization \nand Rancher Manager in SUSE Harvester before 1.8.0 could interfere with the TLS handshake and abuse it \nto bypass TLS as a security control.","severity":"high","cvss":8.6,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","cwe":["CWE-295"],"vendor":"harvester","product":"github.com/harvester/harvester","affected":["github.com/harvester/harvester < 1.8.0"],"patched":["github.com/harvester/harvester 1.8.0"],"published":"2026-06-16","updated":"2026-10-07","sourceUpdated":"2026-10-07T08:10:00.200","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-71261","references":[{"url":"https://github.com/harvester/harvester/security/advisories/GHSA-pgh9-mpwc-8jjf","label":"meissner@suse.de"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71261"},{"url":"https://github.com/harvester/harvester"}],"tags":["nvd","osv","go"],"epss":0.00208,"epssPercentile":0.11025,"aliases":["GHSA-pgh9-mpwc-8jjf","GO-2026-5538"],"ecosystem":"go","ingestedAt":"2026-07-09T18:56:36.675Z","slug":"CVE-2025-71261","body":"## Overview\n\nAn attacker with network-level access between the SUSE Virtualization \nand Rancher Manager in SUSE Harvester before 1.8.0 could interfere with the TLS handshake and abuse it \nto bypass TLS as a security control.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2025-71261)\n\nAffected packages:\n\n- `github.com/harvester/harvester < 1.8.0`\n\nPatched in:\n\n- `github.com/harvester/harvester 1.8.0`\n\nSource: https://osv.dev/vulnerability/GHSA-pgh9-mpwc-8jjf","depth":"twilight","depthScore":47,"depthScoreParts":{"impact":47.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}