{"id":"CVE-2026-81535","title":"In wolfSSH through 1.5.0 built with --enable-fwd, DoChannelOpen() in src/internal.c gates only direct-tcpip channel opens with the forwarding policy callback. forwarded-tcpip opens are admitted without an authorization check and are not …","summary":"In wolfSSH through 1.5.0 built with --enable-fwd, DoChannelOpen() in src/internal.c gates only direct-tcpip channel opens with the forwarding policy callback. forwarded-tcpip opens are admitted without an authorization check and are not …","severity":"critical","cvss":9.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwe":["CWE-862","CWE-863"],"vendor":"wolfssh","product":"wolfssh","affected":["wolfssh < 1.6.0"],"patched":["wolfssh 1.6.0"],"published":"2026-10-07","updated":"2026-10-13","sourceUpdated":"2026-10-13T17:36:15.900","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-81535","references":[{"url":"https://github.com/wolfSSL/wolfssh/commit/616eb681e70759c30c3ba158f2b18d7bd954def8","label":"facts@wolfssl.com"},{"url":"https://github.com/wolfSSL/wolfssh/commit/79a7f299337a28aa561409688a268d0efe6e295c","label":"facts@wolfssl.com"},{"url":"https://github.com/wolfSSL/wolfssh/commit/e396a0a4b6b367f10270287446a4be0071742b5c","label":"facts@wolfssl.com"}],"tags":["nvd","cve.org","score-dispute"],"epss":0.00305,"epssPercentile":0.23122,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-07T18:37:10.078645Z"},"scores":{"nvd":9.1,"cna":6.3},"ingestedAt":"2026-10-07T03:28:55.182Z","slug":"CVE-2026-81535","body":"## Overview\n\nIn wolfSSH through 1.5.0 built with --enable-fwd, DoChannelOpen() in src/internal.c gates only direct-tcpip channel opens with the forwarding policy callback. forwarded-tcpip opens are admitted without an authorization check and are not capped in number, allowing a malicious SSH peer to make an endpoint allocate unbounded per-channel buffers for forwarding channels the application never authorized. A client also does not check a forwarded-tcpip open against the forwards it registered with a tcpip-forward request, as RFC 4254 section 7.2 requires, so a malicious server can open forwarding channels for addresses and ports the client never asked it to forward.\n\n## Affected\n\n- `wolfssh < 1.6.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `wolfssh 1.6.0`","depth":"midnight","depthScore":50,"depthScoreParts":{"impact":50.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":219813,"id":"CVE-2026-81535","ts":1791913172732,"field":"cvss","old":"6.3","new":"9.1"},{"seq":219812,"id":"CVE-2026-81535","ts":1791913172732,"field":"severity","old":"medium","new":"critical"}]}