SSH?

you are misunderstanding me.

I am not attacking ssh because of the cases where the client certs have been compromised, I am mentioning them and saying that such attacks do not count as SSH vulnerabilities (they count as bad deployment decisions on how to use SSH, relying solely on the possession of the client side cert, not requiring anything else)

another poster claimed that SSL without CA validation is meaningless, someone else pointed out that that basically matched what SSH does, and that SSH is therefor vulnerable to the same types of attacks as SSL without CA validation. So the question I am raising is, given that there is far more extensive use of SSH, can anyone show attacks against this supposed severe mitm vulnerability?

programming bugs in SSH don't count (which is what most CVE things are)

attacks that involve compromising the client key don't count as they aren't mitm attacks.