CVE-2026-9547 – SSH improper host validation

CVE ID :CVE-2026-9547

Published : July 3, 2026, 6:18 a.m. | 1 hour, 28 minutes ago

Description :When a libcurl-based application performs transfers via `SCP://` or `SFTP://`
and utilizes the `CURLOPT_SSH_KEYFUNCTION` callback, it may silently accept an
untrusted server. This vulnerability occurs when a server presents a host key
type that does not match the specific key type already recorded for that host
in the `known_hosts` file. Instead of rejecting the mismatch, the callback
mechanism fails to properly enforce the restriction, allowing the connection
to succeed without warning and risking a potential man-in-the-middle attack.

Severity: 0.0 | NA

Visit the link for more details, such as CVSS details, affected products, timeline, and more…