wolfSSL wolfSSH up to 1.5.0 Channel Opening src/internal.c DoChannelOpen improper authorization

Summaryinfo

A vulnerability classified as problematic was found in wolfSSL wolfSSH up to 1.5.0. This vulnerability affects the function DoChannelOpen of the file src/internal.c of the component Channel Opening. Such manipulation leads to improper authorization. This vulnerability is referenced as CVE-2026-81535. It is possible to launch the attack remotely. No exploit is available.

Detailsinfo

A vulnerability was found in wolfSSL wolfSSH up to 1.5.0. It has been rated as problematic. Affected by this issue is the function DoChannelOpen of the file src/internal.c of the component Channel Opening. The manipulation with an unknown input leads to a improper authorization vulnerability. Using CWE to declare the problem leads to CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. Impacted is integrity, and availability. CVE summarizes:

In wolfSSH through 1.5.0 built with --enable-fwd, DoChannelOpen() in src/internal.c gates only direct-tcpip channel opens with the forwarding policy callback. forwarded-tcpip opens are admitted without an authorization check and are not capped in number, allowing a malicious SSH peer to make an endpoint allocate unbounded per-channel buffers for forwarding channels the application never authorized. A client also does not check a forwarded-tcpip open against the forwards it registered with a tcpip-forward request, as RFC 4254 section 7.2 requires, so a malicious server can open forwarding channels for addresses and ports the client never asked it to forward.

The advisory is available at github.com. This vulnerability is handled as CVE-2026-81535 since 08/27/2026. The exploitation is known to be easy. The attack may be launched remotely. Technical details are known, but there is no available exploit. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 10/07/2026). This vulnerability is assigned to T1548.002 by the MITRE ATT&CK project.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-94162). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• wolfSSL

Name

• wolfSSH

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5.0

License

• open-source

Website

• Product: https://github.com/wolfSSL/wolfssh/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion