Paramiko

AutoAddPolicy in Paramiko Disables Host Key Verification and Risks Credential Leakage After IP Reassignment

A developer discovered that fourteen deployment and management scripts all contained hardcoded references to a single VPS IP address. When the provider reassigned the address after migration, the scripts connected to an unrelated server belonging to another customer. The root cause was the line ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy()), which silently accepts any host key instead of raising an exception. The connection succeeded, the root password stored in VPS_PASS was transmitted, and the operation appeared successful in logs. The author replaced AutoAddPolicy with RejectPolicy, centralized the address in a single vps.py module, and switched to key-based authentication with a password fallback. The same class of issue appears in web tools that fetch arbitrary URLs, requiring strict scheme, IP-range, and redirect checks to block SSRF vectors such as 127.0.0.1 and 169.254.169.254. The case demonstrates that host-key verification protects against routine cloud IP reuse rather than only theoretical man-in-the-middle attacks.