Cloudanix VulnDB

GHSA-mxg3-432p-mr72

High · 7.4

goshs: SSH host key verification disabled, allowing transparent MITM of every tunnelled HTTP request

CVSS

7.4

EPSS

—

Published

May 15, 2026

CISA due date

—

The record

The `--tunnel` / `-t` flag opens an outbound SSH connection to `localhost.run:22` with `HostKeyCallback: ssh.InsecureIgnoreHostKey()`. The Go documentation for that function states verbatim: *"It should not be used for production code."* With the callback disabled the client accepts any host key the server presents, so an attacker who can intercept the operator's TCP connection to `localhost.run:22` (any router on the path, malicious local network, ARP/DNS spoof on the operator's LAN, BGP hijack, malicious VPN) can present their own SSH host key, terminate the SSH session locally, and proxy onward — sitting transparently in the middle of the tunnel. Because `localhost.run` does TLS termination at their end, the HTTP traffic on the SSH leg is plaintext, so the on-path attacker reads and rewrites every request and response in cleartext. The goshs operator gets no warning; the public URL works normally.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities