{"id":"52a6e6c3e9802163","repo":"rust-lang/cargo","slug":"error-ssh-host-key-has-changed-for-hostname","errorCode":null,"errorMessage":"error: SSH host key has changed for `{hostname}`\n*********************************\n* WARNING: HOST KEY HAS CHANGED *\n*********************************\nThis may be caused by a man-in-the-middle attack, or the server may have changed its host key.\n\nThe {key_type_short_name} fingerprint for the key from the remote host is:\n    SHA256:{remote_fingerprint}\n\nYou are strongly encouraged to contact the server administrator for `{hostname}` to verify that this new key is correct.\n\nIf you can verify that the server has a new key, you can resolve this error by {old_key_resolution}\n\nThe key provided by the remote host is:\n\n{hostname} {key_type_name} {remote_host_key}\n\nSee https://doc.rust-lang.org/stable/cargo/appendix/git-authentication.html#ssh-known-hosts for more information.\n","messagePattern":"error: SSH host key has changed for `\\{hostname\\}`\n\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\n\\* WARNING: HOST KEY HAS CHANGED \\*\n\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\nThis may be caused by a man-in-the-middle attack, or the server may have changed its host key\\.\n\nThe \\{key_type_short_name\\} fingerprint for the key from the remote host is:\n    SHA256:\\{remote_fingerprint\\}\n\nYou are strongly encouraged to contact the server administrator for `\\{hostname\\}` to verify that this new key is correct\\.\n\nIf you can verify that the server has a new key, you can resolve this error by \\{old_key_resolution\\}\n\nThe key provided by the remote host is:\n\n\\{hostname\\} \\{key_type_name\\} \\{remote_host_key\\}\n\nSee https://doc\\.rust-lang\\.org/stable/cargo/appendix/git-authentication\\.html#ssh-known-hosts for more information\\.\n","errorType":"exception","errorClass":"anyhow::Error","httpStatus":null,"severity":"critical","filePath":"src/sources/git/known_hosts.rs","lineNumber":264,"sourceCode":"                        located at {old_key_location} line {lineno}, \\\n                        and adding the new key to {known_hosts_location}\",\n                    )\n                }\n                KnownHostLocation::Config { definition } => {\n                    format!(\n                        \"removing the old {key_type_name} key for `{hostname}` \\\n                        loaded from Cargo's config at {definition}, \\\n                        and adding the new key to {known_hosts_location}\"\n                    )\n                }\n                KnownHostLocation::Bundled => {\n                    format!(\n                        \"adding the new key to {known_hosts_location}\\n\\\n                        The current host key is bundled as part of Cargo.\"\n                    )\n                }\n            };\n            anyhow::bail!(\n                \"error: SSH host key has changed for `{hostname}`\\n\\\n                *********************************\\n\\\n                * WARNING: HOST KEY HAS CHANGED *\\n\\\n                *********************************\\n\\\n                This may be caused by a man-in-the-middle attack, or the \\\n                server may have changed its host key.\\n\\\n                \\n\\\n                The {key_type_short_name} fingerprint for the key from the remote host is:\\n\\\n                    SHA256:{remote_fingerprint}\\n\\\n                \\n\\\n                You are strongly encouraged to contact the server \\\n                administrator for `{hostname}` to verify that this new key is \\\n                correct.\\n\\\n                \\n\\\n                If you can verify that the server has a new key, you can \\\n                resolve this error by {old_key_resolution}\\n\\\n                \\n\\\n                The key provided by the remote host is:\\n\\","sourceCodeStart":246,"sourceCodeEnd":282,"githubUrl":"https://github.com/rust-lang/cargo/blob/0e07a155371a6ce88ae53a2c00df940280c09a67/src/sources/git/known_hosts.rs#L246-L282","documentation":"Security-critical: the SSH host key for `hostname` matches a known_hosts entry by host but the key itself differs from what was previously recorded. This is the classic man-in-the-middle indicator — either an attacker is intercepting the connection, or the server legitimately rotated its key. Cargo surfaces a prominent warning and refuses to proceed until the old key is removed and the new one verified.","triggerScenarios":"The `HostKeyHasChanged` variant: the server's host key no longer matches the one stored in known_hosts/Cargo config. Common after server reinstall, key rotation, or IP/DNS repointing to a different host. Also the expected signal of an active MITM attack.","commonSituations":"Git server migrated/reinstalled (new host key); load balancer routing to a host with a different key; corporate proxy/MITM; compromised key being replaced; stale known_hosts after infrastructure change.","solutions":["Contact the server administrator and verify the new SHA256 fingerprint is legitimate BEFORE trusting it.","Once verified, remove the old key line (location given in `old_key_resolution`) from `~/.ssh/known_hosts` or Cargo config, then add the new key (reconnect or use `ssh-keyscan`).","If unintentional, treat as a security incident — investigate for MITM before changing anything.","For legitimate rotation, communicate the new fingerprint to all developers/CI to update their known_hosts."],"exampleFix":"# before: stale known_hosts entry causes refusal\nssh-keygen -R example.com\nssh-keyscan example.com >> ~/.ssh/known_hosts\ncargo fetch","handlingStrategy":"validation","validationCode":"# Before connecting, confirm the remote key matches the recorded one:\nssh-keygen -F example.com -f ~/.ssh/known_hosts  # shows stored key\nssh-keyscan example.com | ssh-keygen -l -f -      # shows remote fingerprint\n# Compare fingerprints; only proceed if they match (or rotation is confirmed).","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Treat host-key-change errors as security incidents until proven otherwise.","Communicate planned key rotations to all developers and update CI known_hosts proactively.","Pin host keys in version-controlled `net.ssh.known-hosts` for reproducibility."],"tags":["ssh","git","security","host-key","mitm","known-hosts"],"analyzedSha":"0e07a155371a6ce88ae53a2c00df940280c09a67","analyzedAt":"2026-08-06T01:46:58.334Z","schemaVersion":2}