CVE-2021-36370

An issue was discovered in Midnight Commander through 4.8.26. When establishing an SFTP connection, the fingerprint of the server is neither checked nor displayed. As a result, a user connects to the server without the ability to verify its authenticity.

• CWE-287

• https://docs.ssh-mitm.at/CVE-2021-36370.htmlExploit, Third Party Advisory
• https://github.com/MidnightCommander/mc/blob/5c1d3c55dd15356ec7d079084d904b7b0fd58d3e/src/vfs/sftpfs/connection.c#L484Exploit, Third Party Advisory
• https://github.com/MidnightCommander/mc/blob/master/src/vfs/sftpfs/connection.cExploit, Third Party Advisory
• https://mail.gnome.org/archives/mc-devel/2021-August/msg00008.htmlRelease Notes, Third Party Advisory
• https://midnight-commander.org/Vendor Advisory
• https://sourceforge.net/projects/mcwin32/files/Product, Third Party Advisory
• https://docs.ssh-mitm.at/CVE-2021-36370.htmlExploit, Third Party Advisory
• https://github.com/MidnightCommander/mc/blob/5c1d3c55dd15356ec7d079084d904b7b0fd58d3e/src/vfs/sftpfs/connection.c#L484Exploit, Third Party Advisory
• https://github.com/MidnightCommander/mc/blob/master/src/vfs/sftpfs/connection.cExploit, Third Party Advisory
• https://mail.gnome.org/archives/mc-devel/2021-August/msg00008.htmlRelease Notes, Third Party Advisory
• https://midnight-commander.org/Vendor Advisory
• https://sourceforge.net/projects/mcwin32/files/Product, Third Party Advisory

Published

Aug 30, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-36365Nagios XI before 5.8.5 has Incorrect Permission Assignment f…9.8
• CVE-2021-36366Nagios XI before 5.8.5 incorrectly allows manage_services.sh…9.8
• CVE-2021-36367PuTTY through 0.75 proceeds with establishing an SSH session…8.1
• CVE-2021-36368An issue was discovered in OpenSSH before 8.9. If a client i…3.7
• CVE-2021-36369An issue was discovered in Dropbear through 2020.81. Due to …7.5
• CVE-2021-3637A flaw was found in keycloak-model-infinispan in keycloak ve…7.5
• CVE-2021-36371Emissary-Ingress (formerly Ambassador API Gateway) through 1…3.7
• CVE-2021-36372In Apache Ozone versions prior to 1.2.0, Initially generated…9.8
• CVE-2021-36373When reading a specially crafted TAR archive an Apache Ant b…5.5
• CVE-2021-36374When reading a specially crafted ZIP archive, or a derived f…5.5
• CVE-2021-36376dandavison delta before 0.8.3 on Windows resolves an executa…7.8
• CVE-2021-36377Fossil before 2.14.2 and 2.15.x before 2.15.2 often skips th…7.5