GHSA-MXG3-432P-MR72: SSH Host Key Verification Disabled in goshs

Vulnerability ID: GHSA-MXG3-432P-MR72

CVSS Score: 8.1

Published: 2026-05-15

A critical vulnerability in the Go-based file server goshs allows transparent Man-in-the-Middle (MITM) attacks during SSH tunnel establishment. By utilizing ssh.InsecureIgnoreHostKey() as the HostKeyCallback, versions prior to 2.0.7 fail to validate remote server identity.

TL;DR

goshs versions before 2.0.7 disable SSH host key verification when establishing remote tunnels. This flaw allows an attacker with a privileged network position to intercept the SSH connection and access the underlying unencrypted HTTP traffic.

Technical Details

CWE ID : CWE-295 (Improper Certificate Validation)

Attack Vector : Network (Adjacent/Intercepting)

CVSS v3.1 : 8.1 (Estimated)

Impact : High (Confidentiality & Integrity via MITM)

Exploit Status : None (Unweaponized)

KEV Status : Not Listed

Affected Systems

goshs (versions < 2.0.7)

goshs : < 2.0.7 (Fixed in: 2.0.7 )

Code…