{"id":"CVE-2026-94423","kind":"vulnerability","aliases":["CVE-2026-94423"],"related":[],"title":"Net::LibSSH for Perl: connections skip host key verification, enabling man-in-the-middle","description":"Net::LibSSH versions before 0.004 for Perl authenticate to an unverified server because connect never checks the host key against known_hosts.\n\nconnect reports success as soon as ssh_connect returns SSH_OK. libssh leaves the known-hosts check to the application, and this binding never makes it, so the strict_hostkeycheck and knownhosts options are set on the session and then decide nothing.\n\nPassword, agent and public-key authentication, channel and SFTP operations all run on a session whose peer was never identified, so an attacker who can redirect the connection receives the password when password authentication is used, and commands and data sent over the session.","summary":"Net::LibSSH before 0.004 for Perl never checks the server's host key against known_hosts, so the strict_hostkeycheck and knownhosts options have no effect. An attacker who can redirect the connection gets the password, commands and data sent over the session.","severity":"high","cvss":null,"epss":0.00269,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["automation","net-libssh","package","perl","ssh"],"not_affected_if":["not-using-net-libssh","version-0.004-or-later"],"how_to_check":"- Run `cpanm --info Net::LibSSH` or `perl -MNet::LibSSH -e 'print $Net::LibSSH::VERSION'` and look for a version below `0.004`\n- Search dependency manifests and cpanfile/Makefile.PL for `Net::LibSSH`","fix":"- Upgrade Net::LibSSH to `0.004` or later\n- Until upgraded, verify the server host key yourself before sending credentials","status":"open","published_at":"2026-10-21T22:16:50+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T05:02:00+00:00","updated_at":"2026-10-25T05:02:00+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T05:02:00Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Net::LibSSH to `0.004` or later\n- Until upgraded, verify the server host key yourself before sending credentials","reach":"network","title":"Net::LibSSH for Perl: connections skip host key verification, enabling man-in-the-middle","impact":"high","summary":"Net::LibSSH before 0.004 for Perl never checks the server's host key against known_hosts, so the strict_hostkeycheck and knownhosts options have no effect. An attacker who can redirect the connection gets the password, commands and data sent over the session.","category":"package","nicknames":[],"who_cares":["perl","net-libssh","ssh","automation"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker reads passwords and session data after impersonating the SSH server","analyst_note":"","how_to_check":"- Run `cpanm --info Net::LibSSH` or `perl -MNet::LibSSH -e 'print $Net::LibSSH::VERSION'` and look for a version below `0.004`\n- Search dependency manifests and cpanfile/Makefile.PL for `Net::LibSSH`","needs_analyst":false,"not_affected_if":["not-using-net-libssh","version-0.004-or-later"],"who_is_affected":"Perl applications that use Net::LibSSH to open SSH connections to servers, especially where the connection target could be redirected by DNS, routing or a network an attacker controls. Scripts that only connect to hosts on a fully trusted, isolated network carry less risk, but the upgrade is still the fix.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000632,"input_tokens":3452,"output_tokens":573,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':17A,20A '-94423':18A,21A '0.004':32B,76C 'agent':138C 'applic':114C 'attack':56B,160C 'authent':79C,143C,171C 'autom':22B 'bind':117C 'channel':144C 'check':36B,87C,111C 'command':65B,175C 'connect':5A,61B,85C,94C,101C,165C 'cve':16A,19A 'data':67B,177C 'decid':135C 'effect':54B 'enabl':10A 'get':62B 'host':7A,40B,44B,89C,93C,110C 'hostkeycheck':48B,124C 'identifi':157C 'key':8A,41B,90C,142C 'known':43B,92C,109C 'known-host':108C 'knownhost':50B,126C 'leav':106C 'libssh':2A,25B,30B,73C,105C 'make':119C 'man':12A 'man-in-the-middl':11A 'middl':15A 'net':1A,24B,29B,72C 'net-libssh':23B 'never':35B,86C,118C,156C 'noth':136C 'ok':104C 'oper':147C 'option':51B,127C 'packag':26B 'password':64B,137C,168C,170C 'peer':154C 'perl':4A,27B,34B,78C 'public':141C 'public-key':140C 'receiv':166C 'redirect':59B,163C 'report':95C 'return':102C 'run':149C 'sent':68B,178C 'server':38B,83C 'session':71B,132C,152C,181C 'set':129C 'sftp':146C 'skip':6A 'soon':98C 'ssh':28B,100C,103C 'strict':47B,123C 'success':96C 'unverifi':82C 'use':173C 'verif':9A 'version':74C 'whose':153C","nicknames":[],"mitigations":[],"who_affected":"Perl applications that use Net::LibSSH to open SSH connections to servers, especially where the connection target could be redirected by DNS, routing or a network an attacker controls. Scripts that only connect to hosts on a fully trusted, isolated network carry less risk, but the upgrade is still the fix.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T22:16:50+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-94423","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94423","severity":null,"published_at":"2026-10-21T22:16:50+00:00","modified_at":"2026-10-22T17:21:57+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-94423","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-94423","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}