CVE-2026-126641
Ansible-pylibssh: accepts a changed ssh host key when host_key_auto_add is enabled
- Medium 6.5
Description
A host key verification flaw was found in ansible-pylibssh and in the ansible.netcommon libssh connection plugin. When trust-on-first-use is enabled (host_key_auto_add on the libssh connection plugin, or AutoAddPolicy in ansible-pylibssh), a host that is already present in known_hosts but now presents a different key is accepted without warning. The pylibssh Session.verify_knownhost() method passes the SSH_KNOWN_HOSTS_CHANGED and SSH_KNOWN_HOSTS_OTHER states to the same missing_host_key() policy hook used for unknown hosts, and the bundled AutoAddPolicy/RejectPolicy classes (as well as ansible.netcommon's MyAddPolicy, which is modeled on paramiko's AutoAddPolicy) therefore add the changed key and continue the connection rather than aborting as paramiko's BadHostKeyException path would. As a result the controller authenticates to the substitute host, runs the play there, and appends the new key to known_hosts, which can disclose connection credentials to an attacker performing a machine-in-the-middle attack. Default configurations (host_key_checking enabled, host_key_auto_add unset) are not affected; non-interactive runs fail closed.
Key facts
- Published
- 12 Nov 2026
- Last changed
- 13 Nov 2026
- Assigned by
- redhat
- EPSS
- 0.333% likely to be exploited in the next 30 days, higher than 26.872% of CVEs (scores for 15 Nov 2026)
- SSVC (CISA)
- Exploitation: none; Automatable: no; Technical impact: partial
Severity scores
Each score is shown as its source gave it. They are not averaged or merged.
- 6.5CVSS 3.1, Mediumfrom the CNA (redhat)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
What to do
- Do not enable host_key_auto_add (ansible.netcommon libssh) or AutoAddPolicy (ansible-pylibssh). Keep host_key_checking enabled and pre-populate known_hosts with verified host keys so that a changed key causes the connection to fail closed.CNA workaround statement
Historical context and remediation
This reference retains the original CVE publication date. A recent record update does not mean a new attack occurred.
No separately sourced impact summary is available on this page yet. Consult the description, version data and dated exploitation evidence.
Version statuses below come from the CNA. An “unaffected” version is not necessarily a currently supported release or proof of a patch date. EPSS is a dated risk estimate, not a count of historical attacks.
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Ansible Automation Platform 2 |
|
| Red Hat | Red Hat Ansible Automation Platform 2 |
|
| Red Hat | Red Hat Ansible Automation Platform 2 |
|
| Red Hat | Red Hat Ansible Automation Platform 2 |
|
| Red Hat | Red Hat Ansible Automation Platform 2 |
|
| Red Hat | Red Hat Ansible Automation Platform 2 |
|
Timeline
- 11 Nov 2026 Reported to Red Hat.
- 11 Nov 2026 Made public.
- 12 Nov 2026 Published