This vulnerability (CWE-295) affects SUSE Harvester versions prior to 1.8.0. An attacker positioned on the network path between SUSE Virtualization and Rancher Manager can manipulate the TLS handshake process, effectively bypassing TLS protections. The CVSS 3.1 base score is 8.6, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality, integrity, and availability. No official patch or remediation level has been published yet, and no known exploits in the wild are reported.

Successful exploitation could allow an attacker to bypass TLS security controls, potentially leading to partial disclosure of sensitive information (confidentiality impact), modification of data (integrity impact), and disruption of service (availability impact). The attack requires network-level access but no privileges or user interaction, making it a significant risk in exposed network environments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit network-level access between SUSE Virtualization and Rancher Manager components to trusted networks only. Monitor vendor communications for updates on patches or official mitigations.