Rex through 1.16.1 accepts unknown SSH host keys (CVE-2026-94140)
Original title: CVE-2026-94140: Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync transfers because sync hardcodes StrictHostKeyChecking=no
The Perl automation tool hardcodes StrictHostKeyChecking=no for remote rsync, so an unknown SSH host key is accepted.
Robert Rothenberg reported CVE-2026-94140 in Rex, a Perl automation project, on October 21. Versions through 1.16.1 accept an unknown SSH host key during remote rsync transfers because sync hardcodes StrictHostKeyChecking=no. The oss-security note points to the MetaCPAN distribution and the RexOps GitHub repository. No fixed release or exploitation is stated in the available text.
Unconfirmed: A fixed version is not stated in the available text.
- Posted to oss-security by Robert Rothenberg on October 21.
- Affected range is Rex versions through 1.16.1.
- The flaw is in remote rsync transfers, not a general SSH client bug.
- No patched version is named in the snippet.
Impact: Unknown SSH host keys accepted for remote rsync
| Product | Affected |
|---|---|
| RexOps Rex | through 1.16.1 |
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-94140 | Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync transfers because sync hardcodes StrictHostKeyChecking=no | 9.1 | — |
From the original article
Posted by Robert Rothenberg on Oct 21 ======================================================================== https://metacpan. org/dist/Rex https://github. com/RexOps/Rex Rex...
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.