CVE-2026-94140 Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync transfers because sync hardcodes StrictHostKeyChecking=no

Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync transfers because sync hardcodes StrictHostKeyChecking=no. Every remote branch of sync builds its ssh command with that option, for password authentication, for private-key authentication and for the fallback. Th...

CVE-2026-94140

Rex versions through 1.16.1 for Perl are vulnerable to an issue where they accept an unknown SSH host key during remote rsync transfers. The root cause is that the sync command hardcodes StrictHostKeyChecking=no , and user-defined options via set_openssh_opt do not override this specific command....

CVE-2026-94140 Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync transfers because sync hardcodes StrictHostKeyChecking=no

Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync transfers because sync hardcodes StrictHostKeyChecking=no. Every remote branch of sync builds its ssh command with that option, for password authentication, for private-key authentication and for the fallback. Th...

PT-2026-120829

Name of the Vulnerable Software and Affected Versions Rex versions prior to 1.16.2 Description The software accepts unknown SSH host keys during remote rsync transfers because the sync function hardcodes the StrictHostKeyChecking=no option. This occurs across all remote branches of sync, includin...

kas Persistently Disables SSH Host Key Checking

Summarykas persistently disables SSH host key checking for the invoking user when internal SSH key setup is triggered via SSHPRIVATEKEY or SSHPRIVATEKEYFILE and no user-specific SSH configuration file exists so far.When this path is used, kas creates /.ssh/config with a global Host rule containin...

PT-2026-76462

Summary The AWS Command Line Interface AWS CLI is a unified tool to manage AWS services from the command line. An issue exists where the EMR SSH helper commands aws emr ssh, aws emr socks, aws emr put, aws emr get passed StrictHostKeyChecking=no to the underlying SSH client, disabling host key...

CVE-2026-58065

The Apache Airflow Git provider runs its git-over-SSH operations with "StrictHostKeyChecking=no" by default, disabling SSH host-key verification. An attacker who can intercept the network path between an Airflow worker and the Git server can impersonate the server man-in-the-middle, capturing the...

CVE-2024-4871: Key Exchange without Entity Authentication

A vulnerability was found in Satellite. When running a remote execution job on a host, the host's SSH key is not being checked. When the key changes, the Satellite still connects it because it uses "-o StrictHostKeyChecking=no". This flaw can lead to a man-in-the-middle attack MITM, denial of...