Net::LibSSH before 0.004 skips SSH host-key checks (CVE-2026-94423)
connect() never compares the server host key with known_hosts, so the client can accept an unverified server.
Stories per day · 30 days
2 stories, newest first · one card per story
Stories tagged #host-key
Rex through 1.16.1 accepts unknown SSH host keys (CVE-2026-94140)
The Perl automation tool hardcodes StrictHostKeyChecking=no for remote rsync, so an unknown SSH host key is accepted.