CVE-2025-13914

The record

A Key Exchange without Entity Authentication vulnerability in the SSH implementation of Juniper Networks Apstra allows a unauthenticated, MITM attacker to impersonate managed devices. Due to insufficient SSH host key validation an attacker can perform a machine-in-the-middle attack on the SSH connections from Apstra to managed devices, enabling an attacker to impersonate a managed device and capture user credentials. This issue affects all versions of Apstra before 6.1.1.

Affected packages

Related vulnerabilities

• CVE-2026-94423 Net::LibSSH versions before 0.004 for Perl authenticate to an unverified server because… CWE-322
• CVE-2026-94140 Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync… CWE-322
• CVE-2026-107675 FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the… CWE-322
• CVE-2026-18654 Key exchange without entity authentication in the EMR SSH helper commands in Amazon AWS… CWE-322
• CVE-2026-11745 A vulnerability has been identified in centraldogma-server-mirror-git versions prior to… CWE-322
• CVE-2026-45361 Apache Airflow providers-google's `ComputeEngineSSHHook` disables SSH host-key… CWE-322
• GHSA-mxg3-432p-mr72 goshs: SSH host key verification disabled, allowing transparent MITM of every tunnelled… CWE-322
• CVE-2026-44467 The Claude Desktop app gives you Claude Code with a graphical interface built for running… CWE-322