Rex for Perl versions 1.16.1 and earlier build an SSH command for rsync transfers with the option StrictHostKeyChecking=no hard‑coded. As a result, the tool ignores any unknown or mismatched SSH host keys and never verifies the key presented by the remote server. If an attacker can intercept the initial connection and present a fabricated host key, the transfer will proceed using that key. Under password authentication the tool transmits the plain password over the channel, and under key authentication the attacker receives a copy of the data being uploaded or downloaded, enabling data theft or injection.

The vulnerability affects the Rex framework for Perl, specifically versions 1.16.1 through 1.16.1 and earlier. No other vendors, products, or version details are listed.

Because a man‑in‑the‑middle can supply any host key prior to key exchange, the attack can be executed by simply controlling the network path to the target. No configuration option restores host key checking, making mitigation impossible until an official patch is released. The EPSS score of <1% indicates a low probability of exploitation, but the vulnerability is not listed in CISA’s KEV catalog, yet high risk remains due to the complete bypass of SSH host key validation and the potential for arbitrary data transfer.