A flaw in the libssh library allows an attacker on a Windows system to perform local man‑in‑the‑middle attacks, downgrade SSH encryption, and manipulate trusted host information. The vulnerability arises from an insecure default configuration that automatically loads configuration files from the C:\etc directory, a location that can be created and modified by unprivileged local users. Because the attacker can control these configuration files, they can impersonate a remote host, capture credentials, or inject arbitrary commands, threatening confidentiality, integrity, and availability of SSH communications.

Red Hat Enterprise Linux 10, 6, 7, 8, and 9, as well as Red Hat Hardened Images and Red Hat OpenShift Container Platform 4, contain the vulnerable libssh library. The flaw becomes relevant whenever an installed instance of libssh runs on a Windows operating system that allows local users to create or modify the C:\etc directory, thus exposing the software to the described risk.

The CVSS score of 7.8 indicates high severity, yet the EPSS score is less than 1% and the vulnerability is not listed in CISA’s KEV catalog, suggesting exploitation attempts are currently rare. The likely attack vector is local: an adversary with access to a Windows machine can create or alter files in C:\etc so that libssh loads attacker‑controlled configuration. Because the flaw requires local file‑system tampering, a purely remote attacker cannot exploit it without additional privileges. Nevertheless, once the configuration files are subverted, the attacker can perform a full‑blown man‑in‑the‑middle, compromising data in transit and potentially enabling further attacks from the compromised host.