Cyber ·
CVE-2026-94423: Net::LibSSH accepts server without verifying host key
CPAN Security Group advisory on the Net-LibSSH distribution: versions before 0.004 do not check the host key against known_hosts when connecting. The text was published on the oss-sec feed on October 21, 2026.
The advisory CVE-2026-94423, issued by the CPAN Security Group, concerns the Net-LibSSH distribution for Perl. According to the available part of the text, versions before 0.004 do not verify the server's host key against the known_hosts file when connecting. In practice, a client running those versions may accept a server's identity without that check, which allows a false endpoint to pass as the intended destination. The advisory was shared on the oss-sec feed on October 21, 2026; the text received is an automatic translation and the full notice contains additional fields, such as distribution and repository metadata, that are not reproduced here. To consult the original, search for the identifier CVE-2026-94423 in the October 2026 oss-sec list and in the official CPAN pages linked from the advisory itself. To verify, confirm which Net-LibSSH version is installed in your environment and compare it with the affected range described in the advisory.
Original source: CVE-2026-94423: Net::LibSSH pode autenticar em servidor não verificado