{"id":"CVE-2026-94423","aliases":[],"cve":{"records":[{"id":"CVE-2026-94423","source":"CPANSec","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-21T15:32:37.782Z","published":"2026-10-21T21:22:48.593Z","modified":"2026-10-30T17:22:58.601Z"}],"publishers":[{"name":"CPANSec","role":"CNA","organizationId":"9b29abf9-4ab0-4765-b253-1875cd9b441e","modified":"2026-10-21T21:22:48.593Z"},{"name":"CVE","role":"ADP","organizationId":"af854a3a-2127-422b-91ae-364da2661108","modified":"2026-10-22T00:16:44.795Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-30T17:22:58.601Z"}],"references":[{"url":"https://metacpan.org/release/GETTY/Net-LibSSH-0.004/changes","tags":["release-notes"],"source":"CPANSec"},{"url":"https://github.com/Getty/p5-net-libssh/commit/29f509aacddb4b282ac9eb716d5ab326686d09a4.patch","tags":["patch"],"source":"CPANSec"},{"url":"http://www.openwall.com/lists/oss-security/2026/10/21/29","tags":[],"source":"CVE"}],"weaknesses":[{"id":"CWE-322","description":"CWE-322 Key Exchange without Entity Authentication","source":"CPANSec"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-30T17:22:18.468311Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"total"}]}]},"title":"Net::LibSSH versions before 0.004 for Perl authenticate to an unverified server because connect never checks the host key against known_hosts","titleSource":"CPANSec","descriptionSource":"CPANSec","description":"Net::LibSSH versions before 0.004 for Perl authenticate to an unverified server because connect never checks the host key against known_hosts.\n\nconnect reports success as soon as ssh_connect returns SSH_OK. libssh leaves the known-hosts check to the application, and this binding never makes it, so the strict_hostkeycheck and knownhosts options are set on the session and then decide nothing.\n\nPassword, agent and public-key authentication, channel and SFTP operations all run on a session whose peer was never identified, so an attacker who can redirect the connection receives the password when password authentication is used, and commands and data sent over the session.","score":9.1,"severity":"critical","published":"2026-10-21T21:22:48.593Z","modified":"2026-10-30T17:22:58.601Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"","name":"Net-LibSSH","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"0.004","versionType":"custom"}],"defaultStatus":"unaffected","packageURL":"pkg:cpan/Net-LibSSH","cpes":[],"source":"CPANSec","url":"https://www.cve.org/CVERecord?id=CVE-2026-94423"}],"remediation":[{"text":"Upgrade to Net-LibSSH 0.004 or later.","source":"CPANSec","url":"https://www.cve.org/CVERecord?id=CVE-2026-94423"}],"references":["https://metacpan.org/release/GETTY/Net-LibSSH-0.004/changes","https://github.com/Getty/p5-net-libssh/commit/29f509aacddb4b282ac9eb716d5ab326686d09a4.patch","http://www.openwall.com/lists/oss-security/2026/10/21/29"],"sources":[{"name":"CVE","id":"CVE-2026-94423","modified":"2026-10-30T17:22:58.601Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-94423"}],"assessments":[{"source":"CISA-ADP","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","score":9.1}],"sourceAffected":[],"observedAt":"2026-10-30T19:25:09.656Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T01:10:30.655Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[],"aiSummary":{"text":"Net::LibSSH versions before 0.004 for Perl authenticate to unverified servers, as the connect function does not check the host key against known_hosts. This allows an attacker who can redirect the connection to receive passwords when password authentication is used. The weakness is due to key exchange without entity authentication.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-31T10:51:06.063Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-94423"}]}}