CVE-2026-94140Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync transfers because sync hardcodes StrictHostKeyChecking=no
Updated under an hour ago ()
Does this affect you?
It lists no affected products yet. Add what you run and Signals checks it as products are added.
No exploitation reported and no EPSS estimate yet.
Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync transfers because sync hardcodes StrictHostKeyChecking=no. Every remote branch of sync builds its ssh command with that option, for password authentication, for private-key authentication and for the fallback. The ssh options a caller sets through set_openssh_opt reach the OpenSSH transport but not this command, so there is no configuration that restores host key checking for the transfer. An attacker who can redirect the connection before the real host key is known presents their own and the transfer proceeds: under password authentication sync sends the connection password to that server, an upload writes the selected local files to it, and a download writes what it returns to the local destination.
- CVSS
- Not yet scored
- Weakness (CWE)
- CWE-322
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- CPANSec
- NVD analysis
- Received
- Record last updated
- Oct 22, 2026
- First seen by InfoSec Signals
- Oct 21, 2026
Affected products
No affected products are listed yet.
References
- https://metacpan.org/release/FERKI/Rex-1.16.1/source/lib/Rex/Commands/Rsync.pmtechnical-description
- http://www.openwall.com/lists/oss-security/2026/10/21/28
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.