CVE-2026-90623: andreashappe cochise Auth Bypass Vulnerability

CVE-2026-90623 Overview

CVE-2026-90623 affects the andreashappe/cochise project through version 0.4.1. The flaw resides in the asyncssh.connect function within src/cochise/ssh_connection.py, part of the SSH Host Key Handler component. The weakness allows improper certificate validation [CWE-287] during SSH session establishment. An attacker can trigger the condition remotely, though exploitation requires high attack complexity. A public exploit exists, and the maintainer was notified via a public issue report but has not responded at the time of publication.

Critical Impact
Improper SSH host key validation can enable machine-in-the-middle interception of SSH sessions handled by cochise, undermining the integrity of remote connections.

Affected Products

andreashappe/cochise versions up to and including 0.4.1
Component: SSH Host Key Handler (src/cochise/ssh_connection.py)
Function: asyncssh.connect

Discovery Timeline

2026-09-14 - CVE-2026-90623 published to the National Vulnerability Database (NVD)
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-90623

Vulnerability Analysis

The vulnerability sits in cochise's SSH connection setup path. The project calls asyncssh.connect in src/cochise/ssh_connection.py without enforcing strict host key or certificate validation. As a result, the client can accept SSH server credentials that would otherwise be rejected by a correctly configured handler. This weakness maps to [CWE-287] Improper Authentication, specifically the improper validation of the server's cryptographic identity during the handshake.

Because cochise is invoked to drive SSH sessions programmatically, any downstream action taken over the resulting channel inherits the trust decision made at connect time. If that decision is skipped or weakened, the client will proceed with a server whose identity was never cryptographically confirmed.

Root Cause

The root cause is missing or misconfigured host key verification in the call to asyncssh.connect. The asyncssh library requires callers to supply known_hosts or an explicit validator; when this is omitted or set permissively, the server's host key is not checked against a trusted source. The cochise SSH Host Key Handler does not enforce this validation, so any presented host key is accepted.

Attack Vector

The attack vector is network-based and does not require prior authentication or user interaction. An attacker positioned on the network path between the cochise client and the intended SSH server can present a substitute host key and complete the handshake. Once the session is established, the attacker can intercept commands issued by cochise and observe the resulting output. Successful exploitation requires the attacker to hold a suitable network position, which raises attack complexity.

See the GitHub Issue #13 Discussion and the VulDB CVE-2026-90623 entry for the reported technical details and public proof-of-concept references. No verified exploit code is reproduced here.

Detection Methods for CVE-2026-90623

Indicators of Compromise

Unexpected SSH host key changes reported by hosts that interact with cochise-managed sessions.
SSH sessions originating from cochise clients terminating at IP addresses or hostnames outside the sanctioned inventory.
Absence of known_hosts entries or use of client_keys=None and permissive known_hosts=None in cochise deployments.

Detection Strategies

Perform static code review of any deployed cochise fork for calls to asyncssh.connect that omit known_hosts or supply a passthrough validator.
Compare captured SSH server host key fingerprints against a trusted inventory and alert on mismatches from cochise source hosts.
Correlate outbound SSH connections from systems running cochise against a baseline of approved destinations.

Monitoring Recommendations

Enable network flow logging for hosts that run cochise and forward events to a centralized analytics platform for correlation.
Log SSH negotiation metadata, including presented host key fingerprints, and alert on new or changed fingerprints for a given destination.
Track process execution events for the cochise Python entry points to establish an authoritative usage baseline.

How to Mitigate CVE-2026-90623

Immediate Actions Required

Restrict outbound SSH from hosts running cochise to a known allowlist of destinations until a fix is available.
Pin and monitor SSH host key fingerprints for every server that cochise is permitted to reach.
Run cochise only on network segments where machine-in-the-middle positioning by untrusted parties is not feasible.

Patch Information

No official patch has been published at the time of writing. The project maintainer was informed through a public issue but had not responded, per the NVD description and the VulDB Vulnerability #403205 advisory. Track fix availability through the GitHub Cochise Repository and the associated GitHub Issue #13 Discussion.

Workarounds

Wrap or patch calls to asyncssh.connect in local deployments to supply a populated known_hosts file that contains only trusted server keys.
Reject unknown host keys explicitly by supplying a strict validator callback rather than accepting None.
Route SSH traffic from cochise through a hardened bastion that performs its own host key verification before relaying the session.

bash

# Configuration example: pin trusted host keys for cochise's SSH targets
# 1. Collect and verify server host keys out of band
ssh-keyscan -t ed25519,rsa target-host.example.internal >> ~/.cochise/known_hosts

# 2. Ensure the file is referenced when invoking cochise / asyncssh
export COCHISE_KNOWN_HOSTS="$HOME/.cochise/known_hosts"
chmod 600 "$COCHISE_KNOWN_HOSTS"

# 3. Restrict outbound SSH from the cochise host to sanctioned destinations
sudo iptables -A OUTPUT -p tcp --dport 22 -d target-host.example.internal -j ACCEPT
sudo iptables -A OUTPUT -p tcp --dport 22 -j REJECT