CVE-2026-9547: SSH improper host validation
Last updated 2 July 2026
Other sources
When a libcurl-based application performs transfers via SCP:// or SFTP:// and utilizes the CURLOPTSSHKEYFUNCTION callback, it may silently accept an untrusted server. This vulnerability occurs when a server presents a host key type that does not match the specific key type already recorded for that host in the knownhosts file. Instead of rejecting the mismatch, the callback mechanism fails to properly enforce the restriction, allowing the connection to succeed without warning and risking a potential man-in-the-middle attack.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/curlto a version that resolves this vulnerability.Fixed in 8.21.0-2 - Compensating control
Use an external network control to prevent man-in-the-middle risk until proper SSH host key validation is enforced in the libcurl-based SCP/SFTP client (e.g., restrict allowed SSH/SFTP destinations via firewall/ACL to only the expected hosts).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9547?
CVE-2026-9547 has a risk score of 21, indicating a significant vulnerability.
How does CVE-2026-9547 affect SSH connections?
CVE-2026-9547 allows libcurl-based applications to potentially accept untrusted servers when using `SCP://` or `SFTP://` with a specific SSH key validation flaw.
What software is impacted by CVE-2026-9547?
CVE-2026-9547 impacts applications that utilize the libcurl library, specifically versions used in Debian and related systems.
How can I mitigate the risk of CVE-2026-9547?
To mitigate CVE-2026-9547, ensure that you are using the latest version of libcurl and implement proper host key verification.
When was CVE-2026-9547 published?
CVE-2026-9547 was published on July 3, 2026.