CVE-2026-94140

Name of the Vulnerable Software and Affected Versions Rex versions prior to 1.16.2

Description The software accepts unknown SSH host keys during remote rsync transfers because the sync function hardcodes the StrictHostKeyChecking=no option. This occurs across all remote branches of sync, including those used for password authentication, private-key authentication, and fallback mechanisms. Since options configured via set openssh opt() do not apply to this specific command, host key checking cannot be restored. An attacker capable of redirecting the connection before the legitimate host key is established can present a malicious key, leading to the disclosure of connection passwords during password authentication, the unauthorized upload of local files, or the writing of malicious data to a local destination during downloads.

Recommendations Update to version 1.16.2 or later.