Net::LibSSH before 0.004 skips SSH host-key checks (CVE-2026-94423)
Original title: CVE-2026-94423: Net::LibSSH versions before 0.004 for Perl authenticate to an unverified server because connect never checks the host key against known_hosts
connect() never compares the server host key with known_hosts, so the client can accept an unverified server.
Robert Rothenberg reported CVE-2026-94423 in the Perl module Net::LibSSH on oss-security. Versions before 0.004 authenticate to an unverified server because connect never checks the host key against known_hosts. The post links to the MetaCPAN distribution; the snippet does not mention attacks or a release date.
Unconfirmed: The snippet does not confirm that 0.004 is shipped or that anyone has abused the missing check.
- The stated affected range is every Net::LibSSH release before 0.004.
- The missing check is against known_hosts during connect.
- The report was posted to oss-security on October 21.
Impact: SSH clients can authenticate to an unverified server
| Product | Affected | Fixed in |
|---|---|---|
| Net::LibSSH | before 0.004 | 0.004 |
- 1.Upgrade Net::LibSSH to 0.004 or later.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-94423 | Net::LibSSH versions before 0.004 for Perl authenticate to an unverified server because connect never checks the host key against known_hosts | 9.1 | — |
From the original article
Posted by Robert Rothenberg on Oct 21 ======================================================================== https://metacpan. org/dist/Net-LibSSH VCS Repo:...
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.