CVE-2026-94140— Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync transfers because sync hardcodes StrictHostKeyChecking=no
Quick assessment
Affected
CVE-2026-94140
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Perl 版的 Rex 在 1.16.1 及更早版本中，在进行远程 rsync 传输时，会接受未知的 SSH 主机密钥，原因是其 sync 模块硬编码了 选项。 sync 的每个远程分支在构建 ssh 命令时都会包含该选项，无论是用于密码认证、私钥认证，还是作为回退机制。调用者通过 设置的 ssh 选项虽然能传递到 OpenSSH 传输层，但不会应用到该 ssh 命令本身，因此无法通过任何配置恢复对主机密钥的检查。 如果攻击者能够在真实主机密钥被验证之前重定向连接，并伪造自己的主机密钥，则传输将继续进行：在密码认证
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationI. Basic Information for CVE-2026-94140
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync transfers because sync hardcodes StrictHostKeyChecking=no
Source: CVE Program / CVE List V5
Vulnerability Description
Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync transfers because sync hardcodes StrictHostKeyChecking=no.
Every remote branch of sync builds its ssh command with that option, for password authentication, for private-key authentication and for the fallback. The ssh options a caller sets through set_openssh_opt reach the OpenSSH transport but not this command, so there is no configuration that restores host key checking for the transfer.
An attacker who can redirect the connection before the real host key is known presents their own and the transfer proceeds: under password authentication sync sends the connection password to that server, an upload writes the selected local files to it, and a download writes what it returns to the local destination.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
未进行实体认证的密钥交换
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | - | 0 ~ 1.16.1 | - |
|
II. Public POCs for CVE-2026-94140
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-94140
请登录查看更多情报信息。
Other References for CVE-2026-94140 (1)
-
https://metacpan.org/release/FERKI/Rex-1.16.1/source/lib/Rex/Commands/Rsync.pm technical-description
IV. Related Vulnerabilities
Same weakness: CWE-322
-
CVE-2026-94423
Net::LibSSH versions before 0.004 for Perl authenticate to a -
CVE-2026-94135
Apache Airflow SFTP provider: Async SFTP hook disables host- -
CVE-2026-94134
Apache Airflow SSH provider, Apache Airflow SFTP provider: S -
CVE-2026-107675
FFmpeg through 9.0.2 Missing SSH Host Key Verification in sf -
CVE-2026-77703
SSH Host Key Verification Bypass in HAVELSAN's Liman Render
V. Comments for CVE-2026-94140
No comments yet