PatchSiren

FERKI CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

Review FERKI CVE published 2026-10-21

CVE-2026-94140

Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync transfers because sync hardcodes StrictHostKeyChecking=no. This issue allows an attacker who can redirect the connection before the real host key is known to present their own host key, potentially leading to unauthorized access and data transfer. The vulnerability affects remote rsync transfers, allowing attackers to int [truncated]