CVE-2026-126641
Awaiting Analysis Awaiting Analysis - Queue

Host Key Verification Bypass in Ansible-Pylibssh

Publication date: 2026-11-12

Last updated on: 2026-11-12

Assigner: redhat-SADP

Description
A host key verification flaw was found in ansible-pylibssh and in the ansible.netcommon libssh connection plugin. When trust-on-first-use is enabled (host_key_auto_add on the libssh connection plugin, or AutoAddPolicy in ansible-pylibssh), a host that is already present in known_hosts but now presents a different key is accepted without warning. The pylibssh Session.verify_knownhost() method passes the SSH_KNOWN_HOSTS_CHANGED and SSH_KNOWN_HOSTS_OTHER states to the same missing_host_key() policy hook used for unknown hosts, and the bundled AutoAddPolicy/RejectPolicy classes (as well as ansible.netcommon's MyAddPolicy, which is modeled on paramiko's AutoAddPolicy) therefore add the changed key and continue the connection rather than aborting as paramiko's BadHostKeyException path would. As a result the controller authenticates to the substitute host, runs the play there, and appends the new key to known_hosts, which can disclose connection credentials to an attacker performing a machine-in-the-middle attack. Default configurations (host_key_checking enabled, host_key_auto_add unset) are not affected; non-interactive runs fail closed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-12
Last Modified
2026-11-12
Generated
2026-11-12
AI Q&A
2026-11-12
EPSS Evaluated
N/A
NVD
CVE-2026-126641
EUVD
EUVD-2026-124341

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Red Hat Red Hat Ansible Automation Platform 2 *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-322 The product performs a key exchange with an actor without verifying the identity of that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a host key verification flaw in ansible-pylibssh and the ansible.netcommon libssh connection plugin. When trust-on-first-use is enabled, the system accepts a changed SSH host key for a host already in known_hosts without warning. It then authenticates to the substitute host, runs the play, and updates known_hosts with the new key, potentially exposing credentials to a machine-in-the-middle attack.

Detection Guidance

Check if host_key_auto_add or AutoAddPolicy is enabled in your Ansible configuration. Review known_hosts files for unexpected key changes. Use SSH client commands like 'ssh-keygen -F <hostname>' to verify host keys. Monitor logs for connections to unexpected hosts.

Impact Analysis

An attacker could intercept your connection, trick your system into connecting to a malicious host, and capture sensitive credentials or data. This happens only if trust-on-first-use is enabled (e.g., host_key_auto_add or AutoAddPolicy). Default secure settings are unaffected.

Compliance Impact

This vulnerability could potentially violate compliance requirements under GDPR and HIPAA by enabling unauthorized access to sensitive data. If an attacker performs a machine-in-the-middle attack due to the flawed host key verification, they may intercept or manipulate data transfers, leading to unauthorized disclosure or modification of personal or health information. Organizations using default configurations are not affected, but those with trust-on-first-use enabled risk non-compliance.

Mitigation Strategies

Disable host_key_auto_add in ansible.netcommon and AutoAddPolicy in ansible-pylibssh. Ensure host_key_checking is enabled. Pre-populate known_hosts with trusted keys. Update to patched versions if available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-126641. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...