Host Key Verification Flaw in Ansible Product by Red Hat

CVE-2026-126641

What is CVE-2026-126641?

A vulnerability exists in the ansible-pylibssh and ansible.netcommon libssh connection plugin that compromises host key verification. When configured to trust the first connection attempt (host_key_auto_add enabled), the software accepts a host with a different key than what was previously known without providing a warning. This can introduce significant security risks, particularly in scenarios where a malicious entity may execute a machine-in-the-middle attack, leading to potential disclosure of sensitive connection credentials. Safe configurations (with host_key_checking enabled and host_key_auto_add unset) remain unaffected, as non-interactive runs will appropriately fail.

References