A host key verification flaw exists in ansible-pylibssh and the ansible.netcommon libssh connection plugin when trust-on-first-use is enabled. If a host's SSH key changes but is already present in known_hosts, the changed key is accepted without warning, allowing a man-in-the-middle attacker to impersonate the host and potentially capture credentials. Default configurations with host key checking enabled and trust-on-first-use disabled are not affected, and non-interactive runs fail closed.