What vulnerabilities do host keys help address?

Man-in-the middle attacks: When you connect to a remote host, if you cannot reliably verify that the host key is from the host you intend to connect to, you risk the possibility that an adversary has placed a server pretending to be the Secure Shell server between you and the final destination. The server you're actually connecting to is a "man-in-the-middle". This man-in-the-middle is able to see both the username and password information you transmit as you attempt to authenticate. Once intercepted, a man-in-the-middle can use this information to establish a connection with the remote server and see all traffic between you and the remote server.

Depending on your network topology, the risk of man-in-the-middle attack can vary widely. If users and administrators take some very basic steps, the risk of a man-in-the-middle attack can be significantly reduced.