CWE-322
34 published CVEs are weaknesses of this kind, as the records or NVD name it.
- 34Published CVEs34 of them scored
- 17Last 12 monthspublished in the last year
- 5Critical20 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-94423
Net::LibSSH versions before 0.004 for Perl authenticate to an unverified server because connect never checks the host key against known_hosts
Net-LibSSH
Critical9.1 - CVE-2026-94140
Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync transfers because sync hardcodes StrictHostKeyChecking=no
Rex
Critical9.1 - CVE-2026-94135
Apache Airflow SFTP provider: Async SFTP hook disables host-key verification by default
Apache Software Foundation · Apache Airflow SFTP provider
Medium4.3 - CVE-2026-94134
Apache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key verification by default
Apache Software Foundation · Apache Airflow SSH provider
Critical9.1 - CVE-2026-107675
FFmpeg through 9.0.2 Missing SSH Host Key Verification in sftp Protocol
FFmpeg · FFmpeg
Medium6.0 - CVE-2026-77703
SSH Host Key Verification Bypass in HAVELSAN's Liman Render Engine
HAVELSAN Inc. · Liman Render Engine
Medium5.9 - CVE-2026-89422
TLS 1.3 client skips server authentication when ServerHello carries an unsolicited pre_shared_key extension
Erlang · OTP
Critical9.3 - CVE-2026-18654
Disabled SSH host key verification in Amazon AWS CLI EMR helper commands
AWS · aws-cli
Medium6.9 - CVE-2026-58065
Apache Airflow Git provider: Git provider hook defaults to StrictHostKeyChecking=no, disabling SSH host-key verification
Apache Software Foundation · Apache Airflow Git provider
High8.1 - CVE-2026-11745
A vulnerability has been identified in centraldogma-server-mirror-git versions prior to 0.84.0, where the Git mirror SSH client does not verify remote host…
LY Corporation · Central Dogma
High8.8