GHSA-MXG3-432P-MR72: SSH Host Key Verification Disabled in goshs Vulnerability ID: GHSA-MXG3-432P-MR72 CVSS Score: 8.1 Published: 2026-05-15 A critical vulnerability in the Go-based file server goshs allows transparent Man-in-the-Middle (MITM) attacks during SSH tunnel establishment. By utilizing ssh.InsecureIgnoreHostKey() as the HostKeyCallback, versions prior to 2.0.7 fail to validate remote server identity. TL;DR goshs versions before 2.0.7 disable SSH host key verification when establishing remote tunnels. This flaw allows an attacker with a privileged network position to intercept the SSH connection and access the underlying unencrypted HTTP traffic.…