Is CVE-2026-126641 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-126641 being exploited in the wild.

How severe is CVE-2026-126641?

Medium severity, with a CVSS score of 6.5, published 12 November 2026.

Which products and versions are affected?

Ansible.Netcommon libssh connection plugin.

How is CVE-2026-126641 attacked?

It is attacked over the network.

Am I affected by CVE-2026-126641?

Check whether you run Ansible-Pylibssh or Ansible.Netcommon at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126641: ansible-pylibssh host key verification bypass in SSH connection

CVE-2026-126641 · Severity: medium · CVSS 6.5 · Published 2026-11-12

Ansible's SSH connection libraries accept changed SSH host keys when trust-on-first-use mode is enabled, allowing attackers to intercept connections by presenting a different key. This enables man-in-the-middle attacks where credentials can be stolen and plays executed on the attacker's machine instead of the intended target. Default configurations are not affected; only deployments that explicitly enable host_key_auto_add or AutoAddPolicy are vulnerable.

Vendors: Ansible.

Quick answers

Is CVE-2026-126641 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-126641 being exploited in the wild.
How severe is CVE-2026-126641?: Medium severity, with a CVSS score of 6.5, published 12 November 2026.
Which products and versions are affected?: Ansible.Netcommon libssh connection plugin.
Is there a fix for CVE-2026-126641?: No fixed version is recorded yet. Do not enable host_key_auto_add (ansible.netcommon libssh) or AutoAddPolicy (ansible-pylibssh). Keep host_key_checking enabled and pre-populate known_hosts with verified host keys so that a changed key causes the connection to fail closed.</anigation> <parameter name="timeline">[ { "kind": "disclosed", "at": "2026-11-12" } ] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-126641 attacked?: It is attacked over the network.
Am I affected by CVE-2026-126641?: Check whether you run Ansible-Pylibssh or Ansible.Netcommon at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Do not enable host_key_auto_add (ansible.netcommon libssh) or AutoAddPolicy (ansible-pylibssh). Keep host_key_checking enabled and pre-populate known_hosts with verified host keys so that a changed key causes the connection to fail closed.</anigation> <parameter name="timeline">[ { "kind": "disclosed", "at": "2026-11-12" } ]

Technical details

The vulnerability exists in the pylibssh Session.verify_knownhost() method, which incorrectly routes SSH_KNOWN_HOSTS_CHANGED and SSH_KNOWN_HOSTS_OTHER states through the same missing_host_key() policy hook designed for unknown hosts. This causes AutoAddPolicy and MyAddPolicy classes to accept the changed key and continue the connection rather than abort, enabling a network-based man-in-the-middle attack. The attack requires the attacker to be positioned to intercept the connection and a prior known_hosts entry to exist for the target host.

Affected products

Ansible ansible-pylibssh
Ansible ansible.netcommon libssh connection plugin

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.