patrickhener goshs SSH host key verification bypass in tunnel

Executive brief

goshs is a tool used to share files and create web tunnels for local development. A security flaw in its tunneling feature allows an attacker on the same network to intercept and modify all web traffic passing through the tunnel. This could lead to the theft of login credentials, sensitive files, or the injection of malicious code into the web pages being served.

Technical details

The goshs '--tunnel' flag initiates an outbound SSH connection to 'localhost.run' using the 'ssh.InsecureIgnoreHostKey()' callback, which disables all host key verification. An attacker positioned on the network path (e.g., via ARP spoofing, DNS hijacking, or a compromised router) can intercept this connection and present a rogue SSH host key. Because the tunnel carries plaintext HTTP traffic, the attacker can read and modify all requests and responses, including headers, authentication tokens, and body content. This vulnerability was addressed in version 2.0.7 by implementing a Trust-On-First-Use (TOFU) mechanism.

Affected products

• patrickhener goshs <= 2.0.6

Timeline

• 2026-05-11: disclosed
• 2026-05-15: advisory
• 2026-05-15: patched

References

• https://api.github.com/users/offset
• https://github.com/offset
• https://api.github.com/users/offset/gists%7B/gist_id%7D
• https://api.github.com/users/offset/repos
• https://avatars.githubusercontent.com/u/114768995?v=4
• https://api.github.com/users/offset/events%7B/privacy%7D