External risk intelligence

Net::LibSSH Perl Module Connects to Unverified Servers

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-94423

This vulnerability exists in a Perl library used by developers to build SSH client applications. Because the library is a component for software development rather than an internet-facing service or appliance itself, it is not typically exposed to the public internet. Deployment occurs within custom client-side code, making external network-level exposure to this specific library behavior very unlikely.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a vulnerability in a widely used Perl library for SSH connections that fails to verify server identities. This oversight means that connections can be intercepted, potentially exposing sensitive information like passwords and commands when specific authentication or communication methods are used. The primary concern is confirming whether this library is used within your environment and if these vulnerable functions are actively employed.

Unverified server connections in SSH library.
High-level risk to sensitive data transmission.
Confirm usage and exposure of this library.

Attack Path

How an attacker could exploit the issue

An attacker could trick a user into connecting to a malicious server that impersonates a legitimate one, because the library fails to verify the server's identity. This allows the attacker to intercept sensitive information like passwords and any data sent through the connection.

No specific entry conditions required.
Connect to an unverified server.
Interception of credentials and data.

Live Threat

Current exploitation, exposure, and threat context

When an application uses this library without proper host key verification, an attacker could impersonate a legitimate server. This could allow them to intercept credentials and sensitive data exchanged over SSH connections.

User credentials and session data.
Connection redirection by an attacker.
Credential theft and data interception.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners integrating with SSH services via this Perl library must confirm its presence within their custom client code. The primary action is to identify where the affected library is deployed, assess its reachability and criticality to business operations, and then determine the appropriate remediation strategy, potentially involving vendor coordination or a review of existing security controls.

Application owners should own the issue.
Verify library deployment and reachability first.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Net::LibSSH for Perl?

Net::LibSSH is a Perl module that provides an interface to the libssh library. Developers use it to build software that creates SSH connections, such as automated scripts or client tools, allowing programs to securely connect to remote servers for tasks like executing commands or transferring files.

How does CVE-2026-94423 affect SSH security?

This vulnerability falls under CWE-322: Key Exchange without Cryptographic Authentication. It means the software fails to perform the essential 'host key check' during the initial connection. Because it does not verify the identity of the server it is connecting to, the client cannot confirm it is speaking to the intended host, allowing an attacker to impersonate the server.

When does this vulnerability trigger?

The flaw occurs automatically whenever the library establishes a connection. It is not triggered by specific user actions or complex inputs; rather, it is a foundational defect in how the library manages session initialization. Simply setting security options like 'strict_hostkeycheck' in the code has no effect, as the library fails to act on these settings, leaving all subsequent traffic vulnerable to interception.

Is my system at risk from this SSH flaw?

According to Halo Surface Signal, this risk is very unlikely for most systems. Because Net::LibSSH is a development library embedded in custom code rather than a standalone network appliance, it is rarely exposed directly to the internet. You should primarily care if your developers have built custom client-side tools that use this specific library to reach out to remote infrastructure.

How do I address CVE-2026-94423 in my environment?

Start by identifying all internal software projects that rely on Net::LibSSH for Perl. Once the library is located, assess whether those applications are actively maintaining SSH sessions. The necessary step is to update the library to version 0.004 or later, which addresses the underlying authentication failure, and ensure your development teams review how they integrate this module.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.