ansible libssh accepts changed host keys when auto-add is on
Original title: CVE-2026-126641: ansible-pylibssh / ansible.netcommon libssh: changed SSH host key accepted when host_key_auto_add is enabled
Red Hat confirmed CVE-2026-126641 and lifted the embargo on November 12; the post is truncated.
A public disclosure describes CVE-2026-126641, a host-key verification flaw in ansible-pylibssh and the ansible.netcommon libssh connection plugin. When trust-on-first-use is enabled, a host already listed in known_hosts but now presenting a changed key can be accepted. Red Hat Product Security confirmed the issue, assigned the CVE, and lifted the embargo on November 12.
Unconfirmed: The post is cut off before the full condition, impact, and any fix are stated.
- The setting is host_key_auto_add on ansible.netcommon's libssh plugin.
- In pylibssh, the related setting is AutoAddPolicy.
- No fixed version is stated in the available snippet.
Impact: Changed SSH host key accepted under trust-on-first-use
| Product | Affected |
|---|---|
| ansible-pylibssh | — |
| ansible.netcommon libssh connection plugin | — |
- CVEs
- CVE-2026-126641
- Organizations
- Red Hat Product Security
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-126641 | Changed SSH host key accepted in Ansible libssh auto-add | 6.5 | — |
From the original article
Posted by Ryo utomo on Nov 12 Hello, This is a public disclosure of CVE-2026-126641, a host key verification flaw in ansible-pylibssh and in the ansible. netcommon libssh connection plugin. Red Hat Product Security confirmed the issue, assigned the CVE and lifted the embargo on 2026-11-12.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.