Harvester vulnerabilities

2 known vulnerabilities in Harvester from SUSE. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.6 High severity

  Harvester: Improper Certificate Validation

  CVE-2025-71261Jun 16, 2026SUSE

  An attacker with network-level access between the SUSE Virtualization and Rancher Manager in SUSE Harvester before 1.8.0 could interfere with the TLS handshake and abuse it to bypass TLS as a security control.

• 9.8 Critical severity

  harvester: Initialization of a Resource with an Insecure Default

  CVE-2025-62877Jan 8, 2026SUSE

  Projects using the SUSE Virtualization (Harvester) environment may expose the OS default ssh login password if they are using the 1.5.x or 1.6.x interactive installer to either create a new cluster or add new hosts to an existing cluster. The environment is no