Unverified Server Authentication Vulnerability in Net::LibSSH by Getty

CVE-2026-94423

What is CVE-2026-94423?

The vulnerability in Net::LibSSH arises from improper verification during server authentication. Specifically, earlier versions fail to check the host key against known_hosts, permitting connections to unverified servers. As a result, when the ssh_connect process returns SSH_OK, the connection is deemed successful, bypassing critical security checks. This oversight allows an attacker who can intercept the connection to capture sensitive data, including passwords and commands transmitted over the session, fundamentally compromising the application's security.

References