CVE-2026-86231 in jsch
Summary
by MITRE • 09/07/2026
A security flaw has been discovered in mwiede jsch up to 2.28.5. Affected is the function getRevokedKeys of the file src/main/java/com/jcraft/jsch/KnownHosts.java. Performing a manipulation of the argument known_hosts results in improper check for certificate revocation. The attack is possible to be carried out remotely. The attack is considered to have high complexity. The exploitability is told to be difficult. The exploit has been released to the public and may be used for attacks. Upgrading to version 2.28.6 is able to address this issue. The patch is named 194a2f76a5c0f1c3f778565be3fd66bcafc42d23. You should upgrade the affected component.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/07/2026
A critical security vulnerability has been identified in the mwiede jsch library, specifically affecting versions up to 2.28.5. This flaw resides within the getRevokedKeys function located in the src/main/java/com/jcraft/jsch/KnownHosts.java source file. The core technical issue stems from improper input validation and handling of the known_hosts argument passed to this function. When an attacker manipulates this argument, it leads to a failure in correctly checking certificate revocation status. This logic error allows malicious actors to bypass security controls that are designed to prevent connections with revoked or untrusted certificates, thereby undermining the integrity of secure shell sessions established through this library.
The operational impact of this vulnerability is significant as it compromises the trust model inherent in SSH communications. By exploiting the improper check for certificate revocation, an attacker can potentially establish unauthorized access or intercept sensitive data during transmission. Although the attack vector requires remote execution and is characterized by high complexity with difficult exploitability, the existence of a public proof-of-concept significantly lowers the barrier to entry for less sophisticated attackers. The availability of this exploit in the wild increases the likelihood of real-world attacks targeting systems that rely on vulnerable versions of jsch for secure connectivity.
From a classification perspective, this vulnerability aligns with CWE-20 Improper Input Validation and potentially CWE-345 Insufficient Verification of Data Authenticity within the context of certificate handling. In terms of adversary tactics, it relates to techniques found in MITRE ATT&CK that involve bypassing authentication mechanisms or exploiting trust relationships. The flaw essentially allows an attacker to manipulate the host key verification process, which is a fundamental component of SSH security architecture. This misconfiguration can lead to man-in-the-middle scenarios where the client fails to detect that the server's certificate has been revoked by its issuing authority.
To mitigate this risk, immediate action is required to upgrade the affected component to version 2.28.6 or later. The developers have addressed this issue through a specific patch identified as commit hash 194a2f76a5c0f1c3f778565be3fd66bcafc42d23. This update corrects the logic within the getRevokedKeys function to ensure that certificate revocation checks are performed accurately regardless of input manipulation. Organizations utilizing jsch for secure shell operations should prioritize this upgrade in their patch management cycles to restore proper security controls and prevent potential exploitation by malicious actors seeking to compromise system integrity or confidentiality.