CVE-2026-119568 in vsftpd
Summary
by MITRE • 10/30/2026
vsftpd through 3.0.5 contains an authentication bypass vulnerability in ssl_data_accept() that allows unauthenticated attackers to hijack FTPS data connections by resuming their own TLS session ticket. Attackers sharing the victim's source IP can obtain a ticket via AUTH TLS, then connect to the victim's PASV port to steal downloads or inject upload data.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability in vsftpd versions through 3.0.5 represents a critical flaw within the SSL/TLS implementation, specifically located in the ssl_data_accept function responsible for handling secure control channel negotiations and subsequent data connection establishment. This authentication bypass allows unauthenticated attackers to manipulate TLS session resumption mechanisms to hijack FTPS data connections. The core technical issue stems from how the server validates or accepts resumed TLS sessions without sufficiently binding them to the specific client identity that initiated the original handshake, creating a gap in state verification during the transition from control channel authorization to data channel establishment.
The operational mechanism of this exploit relies on the behavior of TLS session tickets, which are used to optimize connection setup by allowing clients and servers to resume previous sessions without performing full handshakes. An attacker positioned within the same network segment as the victim can initiate an AUTH TLS command to establish a secure control channel with vsftpd. During this process, the server issues a session ticket that encapsulates the cryptographic state required for resumption. Because the vulnerability lies in ssl_data_accept, the server fails to strictly verify that the entity attempting to resume this specific session ticket is the same originator who received it or possesses valid authentication credentials for the target FTP account.
This flaw enables an attacker sharing the victim's source IP address to exploit network-level proximity and protocol behavior. By connecting to the PASV port of the vsftpd server, which provides instructions on where to establish data connections, the attacker can attempt to resume their own TLS session ticket against this new connection endpoint. Due to the lack of strict binding between the resumed session context and the authenticated user identity or original control channel state, the server may accept the resumption request as valid for the ongoing FTP transaction. This effectively bypasses the authentication requirement that should protect data transfers, allowing the attacker to impersonate the victim's data connection flow.
The impact of this vulnerability is severe in environments where vsftpd serves sensitive files or accepts uploads from multiple users over shared network infrastructure such as public Wi-Fi, corporate LANs, or cloud hosting networks with NATed IP addresses. Attackers can intercept and steal downloads intended for legitimate users by hijacking the data stream before it reaches its destination. Furthermore, they possess the capability to inject malicious upload data into active sessions, potentially compromising file integrity or introducing malware under the guise of authorized uploads. This undermines both confidentiality and integrity assurances provided by FTPS protocols.
Mitigation strategies primarily involve upgrading vsftpd to a version where this ssl_data_accept logic has been corrected to enforce strict session binding and authentication verification during TLS resumption for data connections. Until an upgrade is feasible, administrators should consider disabling SSL/TLS support if not strictly required, or implementing network-level access controls such as firewalls that restrict FTPS traffic to trusted source IPs only. Additionally, enabling explicit FTP over TLS with rigorous certificate validation and ensuring that session tickets are short-lived can reduce the window of opportunity for exploitation by limiting the validity period of resumption tokens available on the wire.
From a classification perspective, this vulnerability aligns with CWE-287 Improper Authentication, as it involves failing to properly verify identity before granting access to resources. It also relates to CWE-345 Insufficient Verification of Data Authenticity regarding the session state management. In terms of offensive security frameworks like MITRE ATT&CK, this technique maps to T1076 Remote Services: FTP, specifically illustrating how protocol-level flaws can be leveraged for unauthorized access and data exfiltration in remote service environments.