Net::LibSSH: Improper host key verification (CVE-2026-94423)
The Net::LibSSH Perl module fails to verify host keys against known_hosts during connection establishment, enabling man-in-the-middle attacks.
CVE search metadata
CVE search record: CVE-2026-94423. KEV: no. Product: Net::LibSSH (< 0.004). Brief: Net::LibSSH: Improper host key verification (CVE-2026-94423). Brief link: https://feed.craftedsignal.io/briefs/2026-10-net-libssh-mitm/
Triage facts
Revision 1- Applicability
- Net::LibSSH (< 0.004)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 2 public sources
- Freshness
- Revision 1Oct 22, 01:36 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A5Likely
The Perl distribution Net::LibSSH contains a vulnerability (CVE-2026-94423) where the connect function fails to perform host key verification. This allows an attacker positioned in a man-in-the-middle capacity to intercept or spoof SSH traffic, as the client implicitly trusts any server it connects to. This affects all versions of Net::LibSSH prior to 0.004.
Impact
Successful exploitation allows for man-in-the-middle attacks, potentially leading to the interception of sensitive data, credentials, or the execution of malicious commands on the client system if the SSH session is subsequently used for administrative operations.
Recommendation
- Update the Net::LibSSH Perl module to version 0.004 or later.
- Audit applications utilizing Net::LibSSH to identify instances where SSH connections are established to untrusted or external endpoints.
- Implement network-level controls to restrict SSH outbound access to known, verified server IP ranges.
Immediate actions
Upgrade Net::LibSSH to 0.004 or later
Mitigations
Upgrade Net::LibSSH to 0.004 or later
CVE-2026-94423