CVE-2026-81535 wolfSSH SSH client accepts unsolicited forwarded-tcpip channel opens without an authorization check
A malicious SSH peer can trigger unbounded memory allocation and unauthorized channel opens in wolfSSH clients built with forwarding enabled, causing denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-81535?
CVE-2026-81535 is a medium-severity missing authorization vulnerability in wolfSSL Inc. wolfSSH, published on 7 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In wolfSSH through 1.5.0 built with --enable-fwd, DoChannelOpen() in src/internal.c gates only direct-tcpip channel opens with the forwarding policy callback. forwarded-tcpip opens are admitted without an authorization check and are not capped in number, allowing a malicious SSH peer to make an endpoint allocate unbounded per-channel buffers for forwarding channels the application never authorized. A client also does not check a forwarded-tcpip open against the forwards it registered with a tcpip-forward request, as RFC 4254 section 7.2 requires, so a malicious server can open forwarding channels for addresses and ports the client never asked it to forward.
Which versions are affected by CVE-2026-81535?
It affects 1 product.
Products include Wolfssh Wolfssh.
How do I fix CVE-2026-81535?
No fix has been published for CVE-2026-81535 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-81535 being exploited?
There is no known exploitation of CVE-2026-81535 in the wild and no public exploit code.
Other vulnerabilities in wolfSSL Inc. wolfSSH
Sources
Also known as GHSA-cqr9-f685-gr3w.