CVE-2026-9547

Name of the Vulnerable Software and Affected Versions libcurl (affected versions not specified)

Description Applications using libcurl for transfers via SCP:// or SFTP:// that utilize the CURLOPT SSH KEYFUNCTION callback may silently accept an untrusted server. This occurs when a server presents a host key type that differs from the key type recorded for that host in the known hosts file. The callback mechanism fails to enforce the restriction, allowing the connection to proceed without warning, which could lead to a man-in-the-middle attack, where an attacker intercepts communication between two parties.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.