---
id: "CVE-2026-94423"
kind: "vulnerability"
aliases: ["CVE-2026-94423"]
title: "Net::LibSSH for Perl: connections skip host key verification, enabling man-in-the-middle"
severity: "high"
cvss: null
epss: 0.00269
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["automation", "net-libssh", "package", "perl", "ssh"]
not_affected_if: ["not-using-net-libssh", "version-0.004-or-later"]
published_at: "2026-10-21T22:16:50+00:00"
first_seen_at: "2026-10-23T21:57:29+00:00"
updated_at: "2026-10-25T05:02:00+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94423", "first_seen_at": "2026-10-23T21:57:29+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-94423", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# Net::LibSSH for Perl: connections skip host key verification, enabling man-in-the-middle

Net::LibSSH before 0.004 for Perl never checks the server's host key against known_hosts, so the strict_hostkeycheck and knownhosts options have no effect. An attacker who can redirect the connection gets the password, commands and data sent over the session.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `cpanm --info Net::LibSSH` or `perl -MNet::LibSSH -e 'print $Net::LibSSH::VERSION'` and look for a version below `0.004`
- Search dependency manifests and cpanfile/Makefile.PL for `Net::LibSSH`

## Fix

- Upgrade Net::LibSSH to `0.004` or later
- Until upgraded, verify the server host key yourself before sending credentials

## Timeline

- 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-94423
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-94423

## From the sources

Net::LibSSH versions before 0.004 for Perl authenticate to an unverified server because connect never checks the host key against known_hosts.

connect reports success as soon as ssh_connect returns SSH_OK. libssh leaves the known-hosts check to the application, and this binding never makes it, so the strict_hostkeycheck and knownhosts options are set on the session and then decide nothing.

Password, agent and public-key authentication, channel and SFTP operations all run on a session whose peer was never identified, so an attacker who can redirect the connection receives the password when password authentication is used, and commands and data sent over the session.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_