{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3anetlibssh_projectnetlibsshperl/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:net::libssh_project:net::libssh:*:*:*:*:*:perl:*:*"],"_cs_cves":[{"id":"CVE-2026-94423"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Net::LibSSH (\u003c 0.004)"],"_cs_severities":["high"],"_cs_tags":["supply-chain","vulnerability","perl","ssh"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe Perl distribution Net::LibSSH contains a vulnerability (CVE-2026-94423) where the connect function fails to perform host key verification. This allows an attacker positioned in a man-in-the-middle capacity to intercept or spoof SSH traffic, as the client implicitly trusts any server it connects to. This affects all versions of Net::LibSSH prior to 0.004.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for man-in-the-middle attacks, potentially leading to the interception of sensitive data, credentials, or the execution of malicious commands on the client system if the SSH session is subsequently used for administrative operations.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the Net::LibSSH Perl module to version 0.004 or later.\u003c/li\u003e\n\u003cli\u003eAudit applications utilizing Net::LibSSH to identify instances where SSH connections are established to untrusted or external endpoints.\u003c/li\u003e\n\u003cli\u003eImplement network-level controls to restrict SSH outbound access to known, verified server IP ranges.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-22T01:36:30Z","date_published":"2026-10-22T01:36:30Z","id":"https://feed.craftedsignal.io/briefs/2026-10-net-libssh-mitm/","summary":"The Net::LibSSH Perl module fails to verify host keys against known_hosts during connection establishment, enabling man-in-the-middle attacks.","title":"Net::LibSSH: Improper host key verification (CVE-2026-94423)","url":"https://feed.craftedsignal.io/briefs/2026-10-net-libssh-mitm/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:net::libssh_project:net::libssh:*:*:*:*:*:perl:*:*","version":"https://jsonfeed.org/version/1.1"}