Perl Net::LibSSH flaw allows unverified server connections in versions before 0.004
A vulnerability in the Net::LibSSH Perl module lets clients authenticate to unverified servers, exposing users to potential interception until version 0.004 is deployed.
Key points
- Net::LibSSH versions prior to 0.004 fail to verify host keys against known_hosts during connection.
- The flaw allows authentication to unverified servers, as the connect function never checks the host key.
- Robert Rothenberg reported the issue to the oss-security mailing list on Oct 21.
The Net::LibSSH Perl module contains a vulnerability that permits connections to servers without verifying their identity. This flaw affects all versions of the distribution prior to 0.004. According to the official advisory, the connect function never checks the server's host key against the known_hosts file. This omission allows an attacker to authenticate to an unverified server. Users relying on this module for secure shell connections are exposed to potential interception. The CPAN Security Group assigned the identifier CVE-2026-94423 to this issue.
How it unfolded
- Robert Rothenberg posted the advisory to the oss-security mailing list on Oct 21.
- The post detailed that Net::LibSSH versions before 0.004 lack host key verification during the connection phase.
- The CPAN Security Group formalized the finding as CVE-2026-94423, directing users to MetaCPAN for distribution details.
Who is affected
Organizations using the Net::LibSSH Perl module are at risk if they have not updated to version 0.004 or later. The vulnerability exists in the core connection logic of the library, meaning any application or script that imports this module inherits the flaw. Systems that rely on this module for automated SSH tasks, remote management, or secure data transfers are particularly vulnerable. The advisory specifies that versions before 0.004 are affected. There is no indication that newer versions released after this cutoff contain the same defect. Managed service providers should audit their Perl environments to identify dependencies on this specific CPAN distribution.
Our take on the response
The advisory clearly identifies the technical root cause: the absence of host key verification. By pinpointing the exact version threshold, the CPAN Security Group enables precise remediation efforts. The lack of ambiguity in the version numbers helps administrators quickly determine their exposure. However, the advisory does not mention any active exploitation in the wild. That suggests the primary risk is theoretical until attackers discover and weaponize the flaw. The community response appears timely, with the advisory published shortly after the issue was identified. This rapid disclosure helps reduce the window of opportunity for malicious actors.
Who needs to act first
Teams should prioritize systems that use Net::LibSSH for external connections or untrusted network segments. Check whether your Perl applications depend on this module by reviewing dependency trees and package manifests. Identify servers that handle sensitive data or provide remote access, as these are high-value targets for interception.
Before applying any updates, back up current configurations and test the upgrade in a non-production environment. Verify that the new version resolves the host key verification issue without breaking existing scripts. Roll out the fix gradually, monitoring for errors in logging and authentication success rates. Isolate affected systems if an immediate update is not possible.
What to do and how to stay safe: Net::LibSSH
- Audit all Perl environments to identify installations of Net::LibSSH versions prior to 0.004.
- Upgrade the module to version 0.004 or later once the vendor provides the updated package.
- Monitor server logs for unusual connection attempts or authentication anomalies during the transition.
- Review network segmentation policies to limit exposure of systems that cannot be immediately patched.
Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time
General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-94423?
It is a vulnerability in the Net::LibSSH Perl module that allows authentication to an unverified server because connect never checks the host key against known_hosts.
Which versions of Net::LibSSH are affected?
All versions of the Net::LibSSH distribution before 0.004 are affected by this security flaw.
Who reported this vulnerability?
Robert Rothenberg posted the advisory to the oss-security mailing list on Oct 21.
