GCVE-110-VULN-PYPI-2026-000639

If your skopos-fleet remediation remote (SKOPOS_AGENT_REPO_URL) is an SSH URL whose host is a single-label name, such as a Gitea container called gitea, SKOPOS pushes to it with StrictHostKeyChecking=no and UserKnownHostsFile=/dev/null and accepts any host key (remediation.git_push.GitPusher._git). Whoever can answer for that name can receive the pushed remediation commits and serve its own on fetch: a single-label name can be completed by the resolver's search domains to a host on another network, and on a Docker bridge any neighbour container, which has CAP_NET_RAW by default, can take over the git server's address by ARP spoofing. 0.2.1 checks the host key for other remotes but treats every single-label name as a container on this host (remediation.git_push.ssh_remote_is_local). In 0.2.0 no remote was checked (GCVE-110-VULN-PYPI-2026-000616). Affects 0.2.0 and 0.2.1.