Remote SSH Host Key Bypass in Rex for Perl by Ferki

CVE-2026-94140

What is CVE-2026-94140?

The Rex tool for Perl, up to version 1.16.1, contains a critical vulnerability that permits the acceptance of an unknown SSH host key during remote rsync file transfers. This occurs because the application hardcodes the setting 'StrictHostKeyChecking=no', which disables checks for the validity of the SSH host key. Consequently, when a remote transfer is initiated, malicious actors can potentially redirect the connection, substituting their own host key. This oversight allows unauthorized access to sensitive files, as the system may inadvertently send connection passwords, uploads, or downloads to an untrusted server.

References