Security Advisories (1)
CVE-2026-94140 (2026-10-21)

Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync transfers because sync hardcodes StrictHostKeyChecking=no. Every remote branch of sync builds its ssh command with that option, for password authentication, for private-key authentication and for the fallback. The ssh options a caller sets through set_openssh_opt reach the OpenSSH transport but not this command, so there is no configuration that restores host key checking for the transfer. An attacker who can redirect the connection before the real host key is known presents their own and the transfer proceeds: under password authentication sync sends the connection password to that server, an upload writes the selected local files to it, and a download writes what it returns to the local destination.

NAME

Rex::Task - The Task Object

DESCRIPTION

The Task Object. Typically you only need this class if you want to manipulate tasks after their initial creation.

SYNOPSIS

use Rex::Task;

# create a new task
my $task = Rex::Task->new( name => 'testtask' );
$task->set_server('remoteserver');
$task->set_code( sub { say 'Hello'; } );
$task->modify( 'no_ssh', 1 );

# retrieve an existing task
use Rex::TaskList;

my $existing_task = Rex::TaskList->create->get_task('my_task');

METHODS

new

This is the constructor.

$task = Rex::Task->new(
  func => sub { some_code_here },
  server => [ @server ],
  desc => $description,
  no_ssh => $no_ssh,
  hidden => $hidden,
  auth => {
    user      => $user,
    password   => $password,
    private_key => $private_key,
    public_key  => $public_key,
  },
  before => [sub {}, sub {}, ...],
  after  => [sub {}, sub {}, ...],
  around => [sub {}, sub {}, ...],
  before_task_start => [sub {}, sub {}, ...],
  after_task_finished => [sub {}, sub {}, ...],
  name => $task_name,
  executor => Rex::Interface::Executor->create,
  opts => {key1 => val1, key2 => val2, ...},
  args => [arg1, arg2, ...],
);

connection

Returns the current connection object.

executor

Returns the current executor object.

hidden

Returns true if the task is hidden. (Should not be displayed on ,,rex -T''.)

server

Returns the servers on which the task should be executed as an ArrayRef.

set_server(@server)

With this method you can set new servers on which the task should be executed on.

delete_server

Delete every server registered to the task.

current_server

Returns the current server on which the tasks gets executed right now.

desc

Returns the description of a task.

set_desc($description)

Set the description of a task.

is_remote

Returns true (1) if the task will be executed remotely.

is_local

Returns true (1) if the task gets executed on the local host.

is_http

Returns true (1) if the task gets executed over http protocol.

is_https

Returns true (1) if the task gets executed over https protocol.

is_openssh

Returns true (1) if the task gets executed with openssh.

want_connect

Returns true (1) if the task will establish a connection to a remote system.

get_connection_type

This method tries to guess the right connection type for the task and returns it.

Current return values are below:

  • SSH: connect to the remote server using Net::SSH2

  • OpenSSH: connect to the remote server using Net::OpenSSH

  • Local: runs locally (without any connections)

  • HTTP: uses experimental HTTP connection

  • HTTPS: uses experimental HTTPS connection

  • Fake: populate the connection properties, but do not connect

    So you can use this type to iterate over a list of remote hosts, but don't let rex build a connection. For example if you want to use Sys::Virt or other modules.

modify($key, $value)

With this method you can modify values of the task.

rethink_connection

Deletes current connection object.

user

Returns the username the task will use.

set_user($user)

Set the username of a task.

password

Returns the password that will be used.

set_password($password)

Set the password of the task.

name

Returns the name of the task.

code

Returns the code of the task.

set_code(\&code_ref)

Set the code of the task.

run_hook($server, $hook)

This method is used internally to execute the specified hooks.

set_auth($key, $value)

Set the authentication of the task.

$task->set_auth("user", "foo");
$task->set_auth("password", "bar");

merge_auth($server)

Merges the authentication information from $server into the task. Tasks authentication information have precedence.

get_sudo_password

Returns the sudo password.

parallelism

Get the parallelism count of a task.

set_parallelism($count)

Set the parallelism of the task.

connect($server)

Initiate the connection to $server.

disconnect

Disconnect from the current connection.

get_data

Dump task data.

run($server, %options)

Run the task on $server, with %options.

modify_task($task, $key => $value)

Modify $task, by setting $key to $value.

is_task

Returns true(1) if the passed object is a task.

get_tasks

Returns list of tasks.

get_desc

Returns description of task.

exit_on_connect_fail

Returns true if rex should exit on connect failure.

set_exit_on_connect_fail

Sets if rex should exit on connect failure.

get_args

Returns arguments of task.

get_opts

Returns options of task.

set_args

Sets arguments for task.

set_opt

Sets an option for task.

set_opts

Sets options for task.

clone

Clones a task.