CVE-2026-126641— Ansible-pylibssh: accepts a changed ssh host key when host_key_auto_add is enabled

Quick assessment

Affected

Red Hat Red Hat Ansible Automation Platform 2

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在以及的连接插件中，发现了一个主机密钥验证漏洞。当启用“首次使用即信任”机制时（即在连接插件中启用了，或在中启用了），若某个已存在于文件中的主机现在提供了不同的密钥，系统仍会在不发出任何警告的情况下接受该连接。具体而言，的方法将（密钥已变更）和状态传递给了原本用于处理未知主机的策略钩子。因此，内置的和类，以及中基于的建模的类，都会直接添加变更后的密钥并继续建立连接，而不是像的路径那样中断连接。这导致 Ansible 控制器会向替换后的主机进行身份验证，并在该主机上执行任

CVSS 6.5 · Medium Updated Nov 12, 2026

Possible ATT&CK Techniques 2 AI

T1071.001 · Web Protocols T1571 · Non-Standard Port

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Ansible-pylibssh: accepts a changed ssh host key when host_key_auto_add is enabled

Source: CVE Program / CVE List V5

Vulnerability Description

A host key verification flaw was found in ansible-pylibssh and in the ansible.netcommon libssh connection plugin. When trust-on-first-use is enabled (host_key_auto_add on the libssh connection plugin, or AutoAddPolicy in ansible-pylibssh), a host that is already present in known_hosts but now presents a different key is accepted without warning. The pylibssh Session.verify_knownhost() method passes the SSH_KNOWN_HOSTS_CHANGED and SSH_KNOWN_HOSTS_OTHER states to the same missing_host_key() policy hook used for unknown hosts, and the bundled AutoAddPolicy/RejectPolicy classes (as well as ansible.netcommon's MyAddPolicy, which is modeled on paramiko's AutoAddPolicy) therefore add the changed key and continue the connection rather than aborting as paramiko's BadHostKeyException path would. As a result the controller authenticates to the substitute host, runs the play there, and appends the new key to known_hosts, which can disclose connection credentials to an attacker performing a machine-in-the-middle attack. Default configurations (host_key_checking enabled, host_key_auto_add unset) are not affected; non-interactive runs fail closed.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

未进行实体认证的密钥交换

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE
Red Hat	Red Hat Ansible Automation Platform 2	-	`cpe:/a:redhat:ansible_automation_platform:2`
Red Hat	Red Hat Ansible Automation Platform 2	-	`cpe:/a:redhat:ansible_automation_platform:2`
Red Hat	Red Hat Ansible Automation Platform 2	-	`cpe:/a:redhat:ansible_automation_platform:2`
Red Hat	Red Hat Ansible Automation Platform 2	-	`cpe:/a:redhat:ansible_automation_platform:2`
Red Hat	Red Hat Ansible Automation Platform 2	-	`cpe:/a:redhat:ansible_automation_platform:2`
Red Hat	Red Hat Ansible Automation Platform 2	-	`cpe:/a:redhat:ansible_automation_platform:2`

II. Public POCs for CVE-2026-126641

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-126641

请登录查看更多情报信息。

Other References for CVE-2026-126641 (2)

https://access.redhat.com/security/cve/CVE-2026-126641 vdb-entry x_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2571719 issue-tracking x_refsource_REDHAT

https://www.cve.org/CVERecord?id=CVE-2026-126641

Same Patch Batch · Red Hat · 2026-11-12 · 5 CVEs total

CVE-2026-126643	6.5 MEDIUM	Aap-gateway-operator: resource-server secret exposed in plaintext in the automationcontrol
CVE-2026-126642	6.5 MEDIUM	Awx: webhook credential assignment omits use_role check, exposing another user's token
CVE-2026-71367	4.3 MEDIUM	Awx: websocket broadcast groups leak cross-organization job metadata
CVE-2026-126644	3.9 LOW	Ansible.posix: authorized_key module follows a parent-directory symlink allowing writes ou

IV. Related Vulnerabilities

Same product: Red Hat Ansible Automation Platform 2

Same vendor: Red Hat

Same weakness: CWE-322