medium
advisory
Rex: SSH host key vulnerability (CVE-2026-94140)
Rex versions through 1.16.1 for Perl accept unknown SSH host keys during remote rsync transfers due to a hardcoded StrictHostKeyChecking=no configuration.
CVE search metadata
CVE search record: CVE-2026-94140. KEV: no. Product: Rex (through 1.16.1). Brief: Rex: SSH host key vulnerability (CVE-2026-94140). Brief link: https://feed.craftedsignal.io/briefs/2026-10-rex-ssh-mitm/
Triage facts
Revision 1- Applicability
- Rex (through 1.16.1)
- Evidence
- Unknown
- Severity
- Medium
- Sources
- 1 public source
- Freshness
- Revision 1Oct 22, 01:36 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1
Rex versions through 1.16.1 for Perl hardcode 'StrictHostKeyChecking=no', which causes the application to accept unknown SSH host keys when performing remote rsync transfers.