Cyber ·
CVE-2026-94140: Rex accepts unknown host SSH key in remote rsync transfers
Advisory published on the oss-sec list on October 21, 2026 states that Rex, up to version 1.16.1, disables strict SSH host key checking in remote rsync transfers. Rota Nacional does not patch third-party tools; the action rests with whoever runs Rex.
Advisory CVE-2026-94140, published on the oss-sec list on October 21, 2026 and attributed to the CPAN Security Group, concerns Rex, an automation tool written in Perl. According to the text, up to version 1.16.1 Rex disables strict SSH host key checking in remote rsync transfers. This means a connection may accept the key of an unknown host without the check that would confirm the server's identity, which reduces protection against a fake server. The source lists Rex as the affected distribution and versions up to 1.16.1 as affected. Package and repository addresses appear in the original source and are not repeated here.
Relevance for Rota Nacional: the platform does not fix or replace Rex, and this advisory does not describe any Rota feature. If your organization uses Rex for transfer automation, the indicated action is to check the installed version and assess an upgrade following the maintainer's guidance. The summarized source does not state the fixed version, so check the official repository and package registry before deciding.
If the team uses an AI model to study this advisory, paste only the public technical excerpt. Do not include internal host names, keys, passwords, tokens or personal data. The platform detects personal data before inference and applies the organization's policy, but that does not replace checking your own environment.
Original source: CVE-2026-94140: Rex aceita chave SSH de host desconhecida em transferências rsync