# GHSA-mxg3-432p-mr72: goshs: SSH host key verification disabled, allowing transparent MITM of every tunnelled HTTP request > goshs disables SSH host key verification in tunnel mode, allowing on-path attackers to intercept and modify HTTP traffic via MITM. - **Severity:** Not scored - **Exploited in the wild:** Not known - **Login needed:** Not needed - **Attackable:** Local or same network only - **Victim action needed:** A user has to click or open something - **Fix available:** Yes - **Published:** 15 May 2026 - **Also known as:** GO-2026-5519 ## What is GHSA-mxg3-432p-mr72? GHSA-mxg3-432p-mr72 is a vulnerability in goshs.de/goshs, published on 15 May 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link. ### Official description ### Summary The `--tunnel` / `-t` flag opens an outbound SSH connection to `localhost.run:22` with `HostKeyCallback: ssh.InsecureIgnoreHostKey()`. The Go documentation for that function states verbatim: *"It should not be used for production code."* With the callback disabled the client accepts any host key the server presents, so an attacker who can intercept the operator's TCP connection to `localhost.run:22` (any router on the path, malicious local network, ARP/DNS spoof on the operator's LAN, BGP hijack, malicious VPN) can present their own SSH host key, terminate the SSH session locally, and proxy onward — sitting transparently in the middle of the tunnel. Because `localhost.run` does TLS termination at their end, the HTTP traffic on the SSH leg is plaintext, so the on-path attacker reads and rewrites every request and response in cleartext. The goshs operator gets no warning; the public URL works normally. ### Affected Code **File:** `tunnel/tunnel.go` ```go func Start(localIP string, localPort int) (*Tunnel, error) { config := &ssh.ClientConfig{ User: "nokey", Auth: []ssh.AuthMethod{ssh.Password("")}, HostKeyCallback: ssh.InsecureIgnoreHostKey(), // accepts any server key Timeout: 10 * time.Second, BannerCallback: func(banner string) error { return nil }, } client, err := ssh.Dial("tcp", "localhost.run:22", config) ... } ``` There is no fallback verification — no `ssh.FixedHostKey`, no `known_hosts` read, no TOFU pin. Every invocation of `goshs --tunnel` is equally vulnerable. ### Exploit Chain 1. Operator runs `goshs --tunnel`. `tunnel.Start()` opens an SSH client to `localhost.run:22` with `InsecureIgnoreHostKey()`. 2. Attacker positioned on the network path (compromised router, café Wi-Fi MITM, malicious VPN exit, hostile ISP, BGP hijack, or `arpspoof` + DNS spoof on the operator's LAN) intercepts the outbound TCP connection to `localhost.run:22` and answers with their own SSH server. 3. The attacker's fake SSH server presents an attacker-generated host key. The goshs client's `HostKeyCallback` returns nil unconditionally. Handshake completes; the client believes it is talking to `localhost.run`. 4. The attacker proxies the SSH session onward to the real `localhost.run:22`, forwarding the URL capture so `Start()` reads back the genuine `https://*.lhr.life` line and returns successfully. The operator sees the public URL printed to stdout exactly as expected. 5. Every HTTP request arriving at the public URL is routed over the SSH session. The attacker reads every URL, query string, header, body, and `Authorization` value sent by every visitor. 6. For each response the attacker can rewrite the body or headers — serving modified files, injecting HTML/JS, redirecting requests, or stripping `Set-Cookie` attributes. 7. Captured basic-auth credentials give the attacker authenticated access to upload, share-link, catcher, clipboard, and CLI endpoints. If goshs is running credential-collection listeners (SMB/LDAP/SMTP), the captured NTLM hashes and SMTP messages flowing through the tunnel are also exposed. ### Impact - **Confidentiality (High):** all HTTP request and response content is readable by the on-path attacker (URLs, headers, basic-auth `Authorization`, file contents, share-link tokens, the `?goshs-info` JSON dump). - **Integrity (High):** attacker can modify responses in-flight — replace served files, inject `