Bug 2548038 (CVE-2026-107675)

Summary: CVE-2026-107675 ffmpeg: ffmpeg: Information disclosure via missing SFTP host key verification
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: bbrownin
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in FFmpeg. The libssh-based SFTP (SSH File Transfer Protocol) handler fails to verify remote host keys when establishing connections. A remote network attacker capable of intercepting network traffic could exploit this flaw to impersonate legitimate SFTP servers, potentially exposing user credentials and sensitive media data or allowing the delivery of forged content.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2549560, 2549561, 2549562, 2549563, 2549567, 2549568    
Bug Blocks:    

Description OSIDB Bzimport 2026-10-08 15:58:03 UTC 
FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersonate SFTP servers. Attackers performing man-in-the-middle, DNS, or ARP spoofing can capture passwords supplied in sftp URLs, serve forged media, or receive uploaded output.