Is the DLP vulnerable to CVE-2026-9547

Products

• Data Loss Prevention

Issue/Introduction

When a libcurl-based application performs transfers via SCP:// or SFTP:// and utilizes the CURLOPT_SSH_KEYFUNCTION callback, it may silently accept an untrusted server. This vulnerability occurs when a server presents a host key type that does not match the specific key type already recorded for that host in the known_hosts file. Instead of rejecting the mismatch, the callback mechanism fails to properly enforce the restriction, allowing the connection to succeed without warning and risking a potential man-in-the-middle attack.

Resolution

This high-severity vulnerability allows a malicious server to bypass SSH host key verification when a custom SSH key validation callback is registered in libcurl. This product communicates exclusively over HTTPS and has no SSH, SCP, or SFTP protocol support of any kind; no SSH key callback is registered anywhere in the product. The exploit conditions cannot be met, resulting in a verdict of NOT_EXPLOITABLE.