CVE-2026-94140: Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync transfers because sync hardcodes StrictHostKeyChecking=no

As cited

Copy frozen at 2026-10-21 23:22 UTC (site build).

vulnerabilities

CVE-2026-94140: Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync transfers because sync hardcodes StrictHostKeyChecking=no

CVE-2026-94140 affects Rex versions through 1.16.1 for Perl, a configuration management tool. The vulnerability allows acceptance of unknown SSH host keys during remote rsync transfers because the sync function hardcodes StrictHostKeyChecking=no, bypassing host key verification.

Why it matters: Organizations using Rex for infrastructure automation and remote file synchronization face man-in-the-middle risks when deploying configurations, as the tool will connect to any SSH host without verifying its identity.

Source published

2026-10-21 21:57 UTC

First seen by Cybersecurity Tracker

2026-10-21 22:40 UTC