CVE-2026-94423
UNSCOREDDescription
Net::LibSSH versions before 0.004 for Perl authenticate to an unverified server because connect never checks the host key against known_hosts. connect reports success as soon as ssh_connect returns SSH_OK. libssh leaves the known-hosts check to the application, and this binding never makes it, so the strict_hostkeycheck and knownhosts options are set on the session and then decide nothing. Password, agent and public-key authentication, channel and SFTP operations all run on a session whose peer was never identified, so an attacker who can redirect the connection receives the password when password authentication is used, and commands and data sent over the session.
How to fix
No published remediation has been found for this vulnerability's affected products yet.
Mitigation guidance may be in the linked vendor advisories in the References section below.
TridentStack Control tracks known vulnerabilities across your Windows, macOS, and Linux fleet and shows the fix as soon as one is published. See how it works
CVSS v3.1 Vector
No CVSS vector data available.
Exploit Intelligence
Low risk: more likely to be exploited than 19% of all known CVEs.
References
Related Vulnerabilities
Other CWE-322 vulnerabilities, ordered by exploit likelihood. View all
| CVE | Severity | CVSS | EPSS | Exploited | Fix |
|---|---|---|---|---|---|
| CVE-2026-1709 | Critical | 9.4 | 5.8% | - | Fix |
| CVE-2022-39249 | High | 7.5 | 1.3% | - | Fix |
| CVE-2022-39250 | High | 8.6 | 1.2% | - | Fix |
| CVE-2022-39251 | High | 8.6 | 1.2% | - | Fix |
| CVE-2022-39255 | High | 8.6 | 1.0% | - | Fix |
| CVE-2022-39257 | High | 7.5 | 1.0% | - | Fix |
Common questions
How do I fix CVE-2026-94423?
No published fix for CVE-2026-94423 has been found yet. Check the linked vendor advisories for guidance as it becomes available.
Is CVE-2026-94423 being actively exploited?
Not that we know of. CVE-2026-94423 is not in the CISA Known Exploited Vulnerabilities catalog. Its EPSS score of 0.27% is the estimated probability that it will be exploited in the next 30 days. That is higher than 19% of all scored CVEs.
Embed a live status badge for CVE-2026-94423
Markdown
[](https://tridentstack.com/cve/CVE-2026-94423)HTML
<a href="https://tridentstack.com/cve/CVE-2026-94423"><img src="https://tridentstack.com/cve/badge/CVE-2026-94423.svg" alt="CVE-2026-94423"></a>Find and fix vulnerabilities across your fleet
TridentStack Control continuously scans your Windows, macOS, and Linux fleet for known vulnerabilities, prioritizes them by severity and active exploitation, and patches them automatically.
This product uses NVD data but is not endorsed or certified by the NVD. EPSS scores courtesy of FIRST.org (https://www.first.org/epss). Source: CISA KEV Catalog. Data as of 2026-10-22.