CVE-2026-94140

Versions of Rex through 1.16.1 for Perl are vulnerable to a Man-in-the-Middle (MitM) attack during remote rsync transfers. The root cause is that the sync command hardcodes the SSH option StrictHostKeyChecking=no , which persists even if users attempt to set options via set_openssh_opt. This allo...

CVE-2026-94140 Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync transfers because sync hardcodes StrictHostKeyChecking=no

Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync transfers because sync hardcodes StrictHostKeyChecking=no. Every remote branch of sync builds its ssh command with that option, for password authentication, for private-key authentication and for the fallback. Th...