---
id: CVE-2026-81535
title: "In wolfSSH through 1.5.0 built with\_--enable-fwd,\_DoChannelOpen()\_in\_src/internal.c\_gates only\_direct-tcpip\_channel opens with the forwarding policy callback.\_forwarded-tcpip\_opens are admitted without an authorization check and are not …"
summary: "In wolfSSH through 1.5.0 built with\_--enable-fwd,\_DoChannelOpen()\_in\_src/internal.c\_gates only\_direct-tcpip\_channel opens with the forwarding policy callback.\_forwarded-tcpip\_opens are admitted without an authorization check and are not …"
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'
cwe:
  - CWE-862
  - CWE-863
vendor: wolfssh
product: wolfssh
affected:
  - wolfssh < 1.6.0
patched:
  - wolfssh 1.6.0
published: '2026-10-07'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T17:36:15.900'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-81535'
references:
  - url: >-
      https://github.com/wolfSSL/wolfssh/commit/616eb681e70759c30c3ba158f2b18d7bd954def8
    label: facts@wolfssl.com
  - url: >-
      https://github.com/wolfSSL/wolfssh/commit/79a7f299337a28aa561409688a268d0efe6e295c
    label: facts@wolfssl.com
  - url: >-
      https://github.com/wolfSSL/wolfssh/commit/e396a0a4b6b367f10270287446a4be0071742b5c
    label: facts@wolfssl.com
tags:
  - nvd
  - cve.org
  - score-dispute
epss: 0.00305
epssPercentile: 0.23122
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-07T18:37:10.078645Z'
scores:
  nvd: 9.1
  cna: 6.3
ingestedAt: '2026-10-07T03:28:55.182Z'
---

## Overview

In wolfSSH through 1.5.0 built with --enable-fwd, DoChannelOpen() in src/internal.c gates only direct-tcpip channel opens with the forwarding policy callback. forwarded-tcpip opens are admitted without an authorization check and are not capped in number, allowing a malicious SSH peer to make an endpoint allocate unbounded per-channel buffers for forwarding channels the application never authorized. A client also does not check a forwarded-tcpip open against the forwards it registered with a tcpip-forward request, as RFC 4254 section 7.2 requires, so a malicious server can open forwarding channels for addresses and ports the client never asked it to forward.

## Affected

- `wolfssh < 1.6.0`

## Remediation

Upgrade past the affected range:

- `wolfssh 1.6.0`