CVE-2026-48113highCWE-863

CVE-2026-48113: fallo de gravedad alta en jpillora chisel

Chisel: ACL Bypass via Post-Handshake SSH Channel ExtraData Injection

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear chisel+ Monitorear github.com/jpillora/chisel

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.5epss 0.4%
Chisel is a TCP/UDP tunnel, transported over HTTP and secured via SSH. In versions prior to 1.11.5, authenticated clients can bypass --authfile ACL restrictions and tunnel traffic to arbitrary destinations reachable from the server. The ACL is enforced only during the initial handshake against declared remotes, but never on subsequent SSH channels that carry actual traffic. A malicious client can authenticate with a permitted remote, then open channels to any host:port it wants. This issue has been fixed in version 1.11.5.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:H/SA:L
Productos afectados
jpillora · chisel
CVEs relacionadas — jpillora chisel

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-43798HIGHChisel AUTH environment variable not respected in server entrypointEPSS 0.4%