{"dataType":"CVE_RECORD","dataVersion":"1.0","cveMetadata":{"cveId":"GCVE-110-VULN-PYPI-2026-000639","assignerOrgId":"","assignerShortName":"Vulnetix","state":"PUBLISHED","datePublished":"2026-10-27T22:42:51Z","dateUpdated":"2026-10-27T22:55:07Z","dateReserved":""},"containers":{"cna":{"providerMetadata":null,"title":"","descriptions":[{"lang":"en","value":"If your skopos-fleet remediation remote (SKOPOS_AGENT_REPO_URL) is an SSH URL whose host is a single-label name, such as a Gitea container called gitea, SKOPOS pushes to it with StrictHostKeyChecking=no and UserKnownHostsFile=/dev/null and accepts any host key (remediation.git_push.GitPusher._git). Whoever can answer for that name can receive the pushed remediation commits and serve its own on fetch: a single-label name can be completed by the resolver's search domains to a host on another network, and on a Docker bridge any neighbour container, which has CAP_NET_RAW by default, can take over the git server's address by ARP spoofing. 0.2.1 checks the host key for other remotes but treats every single-label name as a container on this host (remediation.git_push.ssh_remote_is_local). In 0.2.0 no remote was checked (GCVE-110-VULN-PYPI-2026-000616). Affects 0.2.0 and 0.2.1.","supportingMedia":null}],"references":[{"url":"https://pypi.org/project/skopos-fleet/","name":"","tags":["advisory"]}],"metrics":[{"format":"","scenarios":null,"cvssV2_0":null,"cvssV3_0":null,"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":4.2,"baseSeverity":"MEDIUM"},"cvssV4_0":null,"other":null}],"problemTypes":[{"descriptions":[{"lang":"en","description":"Improper Certificate Validation","cweId":"CWE-295","type":"CWE"}]}],"affected":[{"vendor":"pypi","product":"skopos-fleet","collectionURL":"https://pypi.org","packageName":"skopos-fleet","repo":"","defaultStatus":"unknown","versions":[{"version":"0.2.0","status":"affected","versionType":"python","lessThan":"","lessThanOrEqual":"0.2.1","changes":null}],"cpes":null,"modules":["skopos.remediation.git_push"],"programFiles":["skopos/remediation/git_push.py"],"programRoutines":[{"name":"skopos.remediation.git_push.ssh_remote_is_local"},{"name":"skopos.remediation.git_push.GitPusher._git"}],"platforms":null}],"cpeApplicability":null,"rejectedReasons":null,"replacedBy":null},"adp":null}}