CVE-2026-9547: libcurl SSH Host Key Type Validation Bypass

Technical summary

CVE-2026-9547 affects libcurl's SSH transport layer when applications implement the CURLOPT_SSH_KEYFUNCTION callback for custom host key verification. The vulnerability stems from improper enforcement of host key type matching between the known_hosts file and the server's presented key. When a server offers a key type that differs from the locally cached entry—for example, an ED25519 key replacing a previously recorded RSA key—the callback mechanism does not reject the connection as expected. Instead, the application proceeds with the transfer, bypassing a critical security check designed to detect potential MITM attacks. The issue is particularly dangerous because it fails silently, leaving users and applications unaware they've connected to a potentially compromised server.

Business impact

Organizations relying on libcurl for automated SSH-based file transfers, backup operations, or remote deployment pipelines face increased risk of data interception and credential theft. If an attacker gains network positioning to redirect traffic or perform DNS spoofing, they could intercept sensitive files being transferred over SCP/SFTP. The silent nature of the vulnerability means detection may only occur after a breach investigation. Applications that depend on host key pinning or known_hosts verification for security posture would experience degraded protection until patched.

Affected systems

All libcurl versions implementing SSH transport with the CURLOPT_SSH_KEYFUNCTION callback are potentially affected. This includes libcurl deployments in server applications, CI/CD pipelines, cloud infrastructure automation, and any networked tool performing SCP or SFTP transfers with custom host key callbacks. The vulnerability does not affect basic curl CLI usage with default verification unless specifically leveraging the callback mechanism. Organizations should audit their applications to identify instances where libcurl is used with SSH_KEYFUNCTION enabled.

Exploitability

Exploitation requires network-level access to intercept or redirect traffic to an attacker-controlled server. The attacker would need to present a SSH host key of a different type than what's recorded in the target's known_hosts file. While not trivially exploitable in air-gapped environments, any organization with internet-connected hosts performing SSH transfers via libcurl faces realistic risk, especially if deployed across untrusted networks or cloud environments. No exploitation in the wild has been publicly documented at this time, and the vulnerability does not appear on CISA's Known Exploited Vulnerabilities catalog.

Remediation

Apply the latest libcurl patch that corrects host key type validation in the SSH_KEYFUNCTION callback. Verify that updates properly enforce key type matching before invoking the callback. Organizations should also review known_hosts file management practices to ensure they remain up-to-date and audit any recent SSH connections for anomalies. Until patching is complete, restrict SSH transfers to private or verified networks where MITM risk is minimal.

Patch guidance

Consult the official curl project advisories and release notes for patched version information. Apply patches through your organization's standard package management or build process. Test updates in non-production environments first, particularly for applications with critical SCP/SFTP workflows. If you cannot immediately patch, disable CURLOPT_SSH_KEYFUNCTION callbacks in favor of libcurl's default host key verification mechanisms where possible.

Detection guidance

Monitor system logs and network traffic for SSH connections to unexpected hosts or repeated failed SSH authentication attempts that precede successful transfers. Check for changes in known_hosts files and validate that key fingerprints match expected values. Application logs should be reviewed for any SSH connection warnings or errors that may indicate callback failures. Implement host-based file integrity monitoring on known_hosts to detect tampering. In network-based detection, look for SSH key exchange anomalies where clients accept key type mismatches.

Why prioritize this

The HIGH CVSS score of 7.4 reflects a combination of network exploitability, high confidentiality and integrity impact, and absence of user interaction barriers. Although active exploitation is not yet tracked, the vulnerability directly undermines SSH security assumptions relied upon by infrastructure automation and data transfer workflows. Organizations with SSH-based pipelines—particularly those managing sensitive data or deployed across untrusted networks—should prioritize patching. The silent failure mode increases risk because attacks may go undetected.

Risk score, explained

The CVSS 3.1 score of 7.4 (HIGH) is derived from: Attack Vector Network (AV:N) indicating remote exploitability, Attack Complexity High (AC:H) reflecting the requirement for network positioning or DNS spoofing, Privileges Required None (PR:N) as the vulnerability requires no authentication, User Interaction None (UI:N) since the failure occurs automatically within the callback, Scope Unchanged (S:U), and dual impact on Confidentiality and Integrity (C:H/I:H) with no availability impact (A:N). The complexity factor acknowledges that successful exploitation requires specific conditions but does not substantially reduce risk given the critical nature of SSH security.

Frequently asked questions