CVE-2026-94140: CWE-322 Key Exchange without Entity Authentication

The vulnerability in Rex versions up to 1.16.1 arises from the sync tool's use of SSH with StrictHostKeyChecking disabled, preventing verification of the remote host's SSH key. The ssh command used for remote rsync transfers is constructed with this option hardcoded, and user-supplied SSH options do not override it. Consequently, an attacker who can intercept or redirect the connection before the legitimate host key is known can impersonate the server. Under password authentication, the client may send credentials to the attacker-controlled server. Additionally, file uploads and downloads can be manipulated, potentially leading to unauthorized data exposure or modification.

An attacker capable of redirecting the SSH connection can impersonate the remote server by presenting a forged SSH host key. This leads to the client accepting the attacker as a trusted host, resulting in the disclosure of passwords during authentication and unauthorized file transfers. This compromises confidentiality and integrity of the data transferred via rsync in Rex. The vulnerability undermines the trust model of SSH host key verification.

No official patch or fix is currently documented. Users should avoid using vulnerable versions of Rex (up to 1.16.1) for remote rsync transfers in untrusted networks. Until a fix is available, consider using alternative methods that enforce strict host key checking or manually verify host keys. Monitor vendor advisories for updates regarding remediation.