Description

A weakness has been identified in andreashappe cochise up to 0.4.1. Affected is the function asyncssh.connect of the file src/cochise/ssh_connection.py of the component SSH Host Key Handler. Executing a manipulation can lead to improper certificate validation. The attack may be launched remotely. The attack requires a high level of complexity. The exploitability is told to be difficult. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.7",
  "pubDate": "2026-09-14T04:16:36.163Z",
  "pubdate": "2026-09-14T04:16:36.163Z",
  "executiveSummary": "A vulnerability involving improper certificate validation has been identified in the SSH Host Key Handler component of andreashappe cochise versions up to 0.4.1.\nThe flaw resides within the asyncssh.connect function in src/cochise/ssh_connection.py.\nThis vulnerability allows a remote attacker to bypass intended host identity verification, potentially enabling Man-in-the-Middle (MitM) attacks.\nWhile the exploit complexity is rated as high and the exploitability as difficult, a public exploit is currently available, increasing the risk of targeted exploitation.\nThe project maintainers have been notified via an issue report but have not yet provided a patch or formal response.\nSuccessful exploitation compromises the integrity and confidentiality of the SSH connection, as the client may inadvertently trust a malicious or spoofed server identity.",
  "technicalDetails": "The vulnerability is situated within the SSH Host Key Handler of the cochise library, specifically in the src/cochise/ssh_connection.py file. The flaw stems from an insecure implementation of the asyncssh.connect function, which fails to properly enforce mandatory SSH host key validation during the initial connection handshake.\nIn a standard secure implementation, the SSH client must verify the server's public key against a known_hosts file or a pre-configured trust anchor. Due to the logic error in asyncssh.connect, the application fails to validate the presented certificate or key fingerprint correctly, allowing an attacker to present an arbitrary or malicious public key during the SSH key exchange phase.\nThe attack flow involves a remote adversary positioning themselves in a network path between the client and the intended server, such as through ARP spoofing, DNS poisoning, or BGP hijacking. Once the connection is initiated, the attacker intercepts the request and presents a rogue SSH public key. Because the vulnerable function does not perform the required validation checks, the client implicitly accepts the attacker-controlled key as the legitimate identity of the server.\nOnce the trust relationship is established, the attacker acts as a transparent proxy. The client proceeds to authenticate against the attacker's server, which may facilitate the interception of sensitive authentication credentials, session tokens, or the decryption of encrypted traffic if the attacker possesses the necessary infrastructure to relay the connection to the legitimate target server.\nThis vulnerability is classified as improper certificate validation. Despite the reported high complexity and difficulty of exploitation—likely due to the prerequisites of network positioning and specific timing requirements—the availability of a public exploit significantly lowers the barrier for motivated attackers. The absence of vendor interaction or a coordinated patch suggests that current installations remain in a state of unmitigated exposure to this integrity-compromising flaw."
}