CVE-2026-94140 FERKI CVE debrief

Who should care

Defenders responsible for systems using Rex for remote rsync transfers, especially in environments where secure SSH host key checking is crucial, should assess exposure and implement secure configurations.

Why it matters

CVE-2026-94140 allows an attacker to present a fake SSH host key for remote rsync transfers in Rex versions through 1.16.1, potentially leading to unauthorized access and data compromise. Defenders should verify exposure, implement secure configurations, and prioritize remediation.

• An attacker could redirect the connection and present a fake host key, potentially leading to unauthorized access.
• The transfer of sensitive data could be compromised, as the connection password and local files could be sent to the attacker's server.
• Defenders need to verify the implementation of secure SSH host key checking for remote rsync transfers.
• Remediation priority is high for environments where Rex is used for remote rsync transfers with unknown SSH host keys.

Technical summary

The Rex Perl module versions through 1.16.1 have a vulnerability in the remote rsync transfer feature. The sync function hardcodes StrictHostKeyChecking=no, which allows an attacker to present a fake SSH host key and potentially intercept sensitive data or execute unauthorized actions. This vulnerability affects remote rsync transfers, allowing attackers to redirect connections and present fake host keys. Defenders should prioritize verifying exposure of Rex versions 1.16.1 or earlier in their environments, especially where remote rsync transfers are used, and assess the implementation of secure SSH host key checking.

Defensive priority

Defenders should prioritize verifying exposure of Rex versions 1.16.1 or earlier in their environments, especially where remote rsync transfers are used, and assess the implementation of secure SSH host key checking.

Recommended defensive actions

• Verify the version of Rex in use and check for exposure to remote rsync transfers with unknown SSH host keys.
• Implement secure SSH host key checking for remote rsync transfers.
• Consider updating Rex to a version that addresses this issue, if available.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and source item provide details on the vulnerability in Rex versions through 1.16.1. The issue is related to the hardcoded StrictHostKeyChecking=no option in the sync function, which affects remote rsync transfers.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.