{"dataType":"CVE_RECORD","dataVersion":"1.0","cveMetadata":{"cveId":"GCVE-110-VULN-PYPI-2026-000616","assignerOrgId":"","assignerShortName":"Vulnetix","state":"PUBLISHED","datePublished":"2026-10-27T04:10:54Z","dateUpdated":"2026-10-27T04:12:09Z","dateReserved":""},"containers":{"cna":{"providerMetadata":null,"title":"","descriptions":[{"lang":"en","value":"skopos-fleet 0.2.0 added a remediation git push (remediation.git_push.GitPusher._git) that runs ssh with StrictHostKeyChecking=no and UserKnownHostsFile=/dev/null whenever an SSH key is configured, on the reasoning that the remote is a Gitea container on the same host. The remote URL is configurable (SKOPOS_AGENT_REPO_URL), so for any other host a party between the collector and the remote can impersonate it, receive the pushed commits and answer fetches with its own. Fixed in 0.2.1: a remote on this host (a loopback address, localhost or a single-label container name) keeps the unchecked policy; every other host is pinned on first use (StrictHostKeyChecking=accept-new) in ~/.skopos/known_hosts (SKOPOS_KNOWN_HOSTS) and refused if its key changes. Affects 0.2.0 only. The collector's own SSH host-key default is a separate weakness (GCVE-110-PYPI-2026-021896).","supportingMedia":null}],"references":[{"url":"https://pypi.org/project/skopos-fleet/","name":"","tags":["advisory"]},{"url":"https://pypi.org/project/skopos-fleet/0.2.1/","name":"skopos-fleet 0.2.1","tags":["release"]}],"metrics":[{"format":"","scenarios":null,"cvssV2_0":null,"cvssV3_0":null,"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":4.8,"baseSeverity":"MEDIUM"},"cvssV4_0":null,"other":null}],"problemTypes":[{"descriptions":[{"lang":"en","description":"Improper Certificate Validation","cweId":"CWE-295","type":"CWE"}]}],"affected":[{"vendor":"pypi","product":"skopos-fleet","collectionURL":"https://pypi.org","packageName":"skopos-fleet","repo":"","defaultStatus":"unaffected","versions":[{"version":"0.2.0","status":"affected","versionType":"python","lessThan":"0.2.1","lessThanOrEqual":"","changes":null},{"version":"0.2.1","status":"unaffected","versionType":"python","lessThan":"","lessThanOrEqual":"","changes":null}],"cpes":null,"modules":["skopos.remediation.git_push"],"programFiles":["skopos/remediation/git_push.py"],"programRoutines":[{"name":"skopos.remediation.git_push.GitPusher._git"}],"platforms":null}],"cpeApplicability":null,"rejectedReasons":null,"replacedBy":null},"adp":null}}