CVE-2026-94423: Net::LibSSH versions before 0.004 for Perl authenticate to an unverified server because connect never checks the host key against known_hosts
Net::LibSSH versions before 0.004 for Perl authenticate to an unverified server because connect never checks the host key against knownhosts.
connect reports success as soon as sshconnect returns SSHOK. libssh leaves the known-hosts check to the application, and this binding never makes it, so the stricthostkeycheck and knownhosts options are set on the session and then decide nothing.
Password, agent and public-key authentication, channel and SFTP operations all run on a session whose peer was never identified, so an attacker who can redirect the connection receives the password when password authentication is used, and commands and data sent over the session.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Net::LibSSHto a version that resolves this vulnerability.Fixed in 0.004
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be able to redirect or intercept the SSH connection so that the client connects to an attacker-controlled server. This affects applications using Net::LibSSH before 0.004, regardless of whether they set the strict_hostkeycheck or knownhosts session options.
What can an attacker obtain or do after intercepting a connection?
If password authentication is used, the attacker can receive the password. Commands, SFTP activity, and other data sent through the SSH session can also be exposed because the peer is never verified before those operations run.
Are public-key and agent authentication safe from this issue?
No. Public-key and agent authentication can proceed on a session whose server identity was never verified, and subsequent channel or SFTP operations are sent to that unverified peer.
How can I determine whether an application is affected?
Check whether it uses cpan/Net::LibSSH before version 0.004. Applications relying on the binding's strict_hostkeycheck or knownhosts options are affected because those options did not cause connect to perform a known-hosts verification.