When a libcurl-based application performs transfers via `SCP://` or `SFTP://` and utilizes the `CURLOPT_SSH_KEYFUNCTION` callback, it may silently accept an untrusted server. This vulnerability occurs when a server presents a host key type that does not match the specific key type already recorded for that host in the `known_hosts` file. Instead of rejecting the mismatch, the callback mechanism fails to properly enforce the restriction, allowing the connection to succeed without warning and risking a potential man‑in‑the‑middle attack.

Any application shipping libcurl that enables SCP or SFTP transfers and employs the `CURLOPT_SSH_KEYFUNCTION` callback is susceptible. The issue affects all libcurl versions up to the latest release that still contains the incomplete enforcement logic. Systems running such applications—including command‑line tools, scripts, or integrated services that rely on libcurl for SSH based file operations—must verify that a fix has been applied.

The CVSS score of 7.4 indicates high severity. With an EPSS score below 1 %, exploitation attempts are expected to be rare but not impossible. Because the vulnerability is not listed in CISA KEV, there is currently no publicly known active exploitation. The attack vector requires the attacker to control or impersonate a server that presents a mismatched host key type. If the application accepts the connection without warning, the attacker can intercept traffic, potentially capturing credentials or data. The mitigation is to apply a patched libcurl or disable the insecure callback usage.