ansible-pylibssh: host key verification flaw

Red Hat Ansible Automation Platform 2

ansible-pylibssh and ansible.netcommon libssh connection plugin vulnerable to host key verification flaw

Do this now

Check the Red Hat advisory for a fix to the ansible-pylibssh host key verification flaw and restrict connections to trusted hosts meanwhile.

First seen: 12 Nov 2026
Last update: 12 Nov 2026, 20:18 UTC
Identifiers: CVE-2026-126641
CVSS: 6.5
Source: news

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## ansible-pylibssh: host key verification flaw
Severity: medium. Patch status: fix status unknown.
Affected: Red Hat Ansible Automation Platform 2
Ids: CVE-2026-126641

ansible-pylibssh and ansible.netcommon libssh connection plugin vulnerable to host key verification flaw

## Steps
1. Search the repo, its CI and infra config for Red Hat Ansible Automation Platform 2. If present, report the version in use and whether it's affected.
2. No source names a fix yet; check the vendor advisory. Until one ships: restrict network access to it.

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-126641") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://seclists.org/oss-sec/2026/q4/684
https://pwned.coffee/i/ansible-pylibssh-host-key-verification-flaw-cve-2026-126641

Timeline

12 Nov 2026, 20:18 UTC
Fix status: no fix yet → unknown.
12 Nov 2026
First reported.

Receipt

Exploitation: No known exploitation
Score: CVSS 6.5 (medium). CVSS 3.1 6.5 (CNA redhat) for CVE-2026-126641
Last checked: 13 Nov 2026, 16:26 UTC

Sources: KEV – CVE record ✓ Vendor –

Sources

seclists.org: CVE-2026-126641: ansible-pylibssh / ansible.netcommon libssh: changed SSH host key accepted when host_key_auto_add is enabled

Follow on X

Totalone coffee