01 Record

CVE-2026-94140

Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync transfers because sync hardcodes StrictHostKeyChecking=no

UnratedPUBLISHEDCNA: CPANSec

CNA base scoreUnratedNo CNA CVSS vector

View raw JSON

02 Description

Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync transfers because sync hardcodes StrictHostKeyChecking=no

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: Not scored by EPSS
EPSS percentile: Not scored by EPSS
NVD base score: The NVD has published no score for this record
NVD CVSS vector: No NVD score to derive
NVD analysis status: Not recorded
Red Hat severity: No Red Hat rating. Red Hat rates the CVEs that affect its products.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2026-10-21 21:22Z55 MIN AGO

Last updated

2026-10-21 21:22Z55 MIN AGO

Reserved

2026-09-20

Assigning CNA

CPANSec

Record state

PUBLISHED

Severity

Not rated by the issuing CNA

CNA CVSS vector

Not published by the issuing CNA

Weaknesses

CWE-322Key Exchange without Entity AuthenticationBase

Data version

5.2

Document digest

a67cfd33de5898d0350092cea4fd9597455df24c0c179539bc2a280818f8b85a

05 Affected products

No products listed

This record names no affected vendor or product. That is common for reserved identifiers and for records whose CNA published only a narrative description.

06 References

metacpan.orghttps://metacpan.org/release/FERKI/Rex-1.16.1/source/lib/Rex/Commands/Rsync.pmtechnical-description

07 Remediation

No fixed CPAN release is currently available.