Answer in brief
CVE-2026-126641 records a Medium severity (CVSS 6.5) vulnerability in Ansible-pylibssh: accepts a changed ssh host key when host_key_auto_add is enabled. The current sources do not mark it as known exploited. The current feed maps Red Hat/ansible-automation-platform-26/ee-supported-rhel9 (generic), Red Hat/ansible-automation-platform-27/ee-supported-rhel9 (generic), Red Hat/python3.11-ansible-pylibssh (generic), Red Hat/python3.12-ansible-pylibssh (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 6.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Red Hat/ansible-automation-platform-26/ee-supported-rhel9 (generic), Red Hat/ansible-automation-platform-27/ee-supported-rhel9 (generic), Red Hat/python3.11-ansible-pylibssh (generic), Red Hat/python3.12-ansible-pylibssh (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Red Hat/ansible-automation-platform-26/ee-supported-rhel9generic | * | Not reported |
| Red Hat/ansible-automation-platform-27/ee-supported-rhel9generic | * | Not reported |
| Red Hat/python3.11-ansible-pylibsshgeneric | * | Not reported |
| Red Hat/python3.12-ansible-pylibsshgeneric | * | Not reported |
| Red Hat/python3x-ansible-pylibsshgeneric | * | Not reported |
| Red Hat/python-ansible-pylibsshgeneric | * | Not reported |
Published upstream
Nov 12, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 12, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Nov 12, 2026
A host key verification flaw was found in ansible-pylibssh and in the ansible.netcommon libssh connection plugin. When trust-on-first-use is enabled (host_key_auto_add on the libssh connection plugin, or AutoAddPolicy in ansible-pylibssh), a host that is already present in known_hosts but now presents a different key is accepted without warning. The pylibssh Session.verify_knownhost() method passes the SSH_KNOWN_HOSTS_CHANGED and SSH_KNOWN_HOSTS_OTHER states to the same missing_host_key() policy hook used for unknown hosts, and the bundled AutoAddPolicy/RejectPolicy classes (as well as ansible.netcommon's MyAddPolicy, which is modeled on paramiko's AutoAddPolicy) therefore add the changed key and continue the connection rather than aborting as paramiko's BadHostKeyException path would. As a result the controller authenticates to the substitute host, runs the play there, and appends the new key to known_hosts, which can disclose connection credentials to an attacker performing a machine-in-the-middle attack. Default configurations (host_key_checking enabled, host_key_auto_add unset) are not affected; non-interactive runs fail closed.
Quoted source text, attributed separately from HOL analysis.