Vulnerability · Published Oct 7, 2026 · Assigned by wolfSSL
CVE-2026-81535wolfSSH SSH client accepts unsolicited forwarded-tcpip channel opens without an authorization check
Medium 6.3
In plain English
A medium-severity missing authorization in wolfSSH from wolfSSL Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
In wolfSSH through 1.5.0 built with --enable-fwd, DoChannelOpen() in src/internal.c gates only direct-tcpip channel opens with the forwarding policy callback. forwarded-tcpip opens are admitted without an authorization check and are not capped in number, allowing a malicious SSH peer to make an endpoint allocate unbounded per-channel buffers for forwarding channels the application never authorized. A client also does not check a forwarded-tcpip open against the forwards it registered with a tcpip-forward request, as RFC 4254 section 7.2 requires, so a malicious server can open forwarding channels for addresses and ports the client never asked it to forward.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.24 | wolfssh | 1.6.0-r0 | ALPINE-CVE-2026-81535 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| wolfSSL Inc. | wolfSSH | 1.4.8 – through 1.5.0 |
Weakness: CWE-862, CWE-863 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N