Database/Control plane, storage & DevOps

ansible-pylibssh / ansible.netcommon: changed SSH host keys silently accepted when auto-add is on

CVSS 6.5CVE-2026-126641Control plane, storage & DevOpscurated

Impact

When trust-on-first-use is enabled, a host already in known_hosts that presents a different key is treated like an unknown host. Its new key is added and the connection goes ahead instead of aborting. Someone in a machine-in-the-middle position can impersonate a managed host, which is often a datacenter switch, since netcommon is the network-device connection path. The controller then sends it credentials and runs the play against it. The default configuration is not affected.

Who can reach it

An attacker with a machine-in-the-middle position between the Ansible controller and managed hosts, for example on the management network. Only applies where host_key_auto_add is set on the libssh connection plugin or where AutoAddPolicy is used in ansible-pylibssh. No authentication is needed.

What to do

The record cites no fixed versions. Follow the Red Hat advisory for patched ansible-pylibssh and ansible.netcommon builds. In the meantime, leave host_key_checking enabled and host_key_auto_add unset, and remove AutoAddPolicy from custom pylibssh code. Audit known_hosts for keys added unexpectedly.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-126641 https://access.redhat.com/security/cve/CVE-2026-126641 https://bugzilla.redhat.com/show_bug.cgi?id=2571719 http://www.openwall.com/lists/oss-security/2026/11/12/6

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.