CVE-2026-90623
Received Received - Intake

Improper Certificate Validation in Cochise SSH Connection

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: VulDB

Description
A weakness has been identified in andreashappe cochise up to 0.4.1. Affected is the function asyncssh.connect of the file src/cochise/ssh_connection.py of the component SSH Host Key Handler. Executing a manipulation can lead to improper certificate validation. The attack may be launched remotely. The attack requires a high level of complexity. The exploitability is told to be difficult. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-14
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-90623
EUVD
EUVD-2026-77190

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
andreashappe cochise to 0.4.1 (inc)
andreashappe cochise 0.4.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-295 The product does not validate, or incorrectly validates, a certificate.
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Cochise LLM-driven pentest agent up to version 0.4.1. It involves two issues: disabled host key verification in SSH connections and lack of sanitization of SSH command output before processing by the LLM. This allows man-in-the-middle attacks and prompt injection, leading to remote code execution.

Detection Guidance

To detect this vulnerability, inspect the Cochise tool's configuration for disabled host key verification in src/cochise/ssh/ssh_connection.py. Check if known_hosts is set to None. Also review src/cochise/agent/executor.py for direct appending of raw SSH output to LLM conversation history without sanitization.

Impact Analysis

An attacker could exploit this to execute arbitrary commands on your system via SSH, steal credentials, or intercept sensitive communications. The attack requires either compromising a target or intercepting a legitimate connection due to disabled host key verification.

Mitigation Strategies

Enable host key verification in the SSH connection handler. Sanitize SSH output before it is processed by the LLM. Add a command validation layer to block sensitive operations. Separate stderr from stdout to prevent prompt injection attacks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90623. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart