# CVE-2026-94423: Net::LibSSH server verification missing in connect

Source: https://junglewise.ai/threats/cve-2026-94423-net-libssh-versions-before-0-004-for-perl-authenticate-to-an  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2026-94423 · Severity: info · Published 2026-10-21

Net::LibSSH is a Perl binding for SSH client connections. Versions before 0.004 accept connections to any SSH server without verifying its identity, allowing man-in-the-middle attackers to intercept credentials and session data when password or public-key authentication is used.

Vendors: [CPAN](https://junglewise.ai/threats/vendors/cpan).

## Quick answers

**Is CVE-2026-94423 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-94423 being exploited in the wild.

**How severe is CVE-2026-94423?** Informational severity, published 21 October 2026.

**Which products and versions are affected?** CPAN Net::LibSSH before 0.004.

**Is there a fix for CVE-2026-94423?** Yes: fixed in 0.004. Until then: Set strict_hostkeycheck => 0 in the connection options only if strict host-key verification is not required for your use case; populate known_hosts with the expected server key using ssh-keyscan or similar tools before connecting.</anigation>
</invoke> Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-94423 attacked?** It is attacked over the network or from the adjacent network, in a software library.

**Am I affected by CVE-2026-94423?** Check whether you run CPAN Net::LibSSH at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 0.004

Set strict_hostkeycheck => 0 in the connection options only if strict host-key verification is not required for your use case; populate known_hosts with the expected server key using ssh-keyscan or similar tools before connecting.</anigation>
</invoke>

## Technical details

The connect() method performs the SSH handshake via ssh_connect() but never validates the server's host key against known_hosts, despite options for this being passed to libssh. An attacker redirecting the connection receives authentication credentials and all commands or data sent over the session. The fix adds a call to ssh_session_is_known_server() after handshake completion to enforce verification by default, with an opt-out via strict_hostkeycheck => 0.

## Affected products

- CPAN Net::LibSSH before 0.004

## Timeline

- 2026-10-21: disclosed
- 2026-09-08: patched

## References

- [https://cpan.org/modules](https://cpan.org/modules)
- [https://github.com/Getty/p5-net-libssh/commit/29f509aacddb4b282ac9eb716d5ab326686d09a4.patch](https://github.com/Getty/p5-net-libssh/commit/29f509aacddb4b282ac9eb716d5ab326686d09a4.patch)