SecNews@SecNews_GR
CVE-2026-109786: Το φίλτρο SSH του Fail2ban μπορεί να αποκλείσει χρήστες https://www.secnews.gr/739901/fail2ban-filtro-ssh-cve-2026-109786/?fsp_sid=18459
0000093
7.0K followersView on X
CVE-2026-109786
LOWCVSS 5.3 · MEDIUMSignal is active with 1 mentions in latest observed window
Immediate actions
- Track advisory updates for patch or workaround availability
Recommended action window: Monitor and triage in normal cycle
NVD description
In fail2ban 0.10.5 through 1.1.1 before ddd879d, the sshd filter (config/filter.d/sshd.conf) accepts an "on <token>" suffix after the host address. Because OpenSSH logs the offered username verbatim, a remote unauthenticated attacker can use a username such as "x VICTIM-SOURCE-IP-ADDRESS on" to make fail2ban associate failed login attempts with an arbitrary source IP address and ban it (e.g., to block logins from a legitimate user). The default filter mode is affected.
0.0/ 10 priority
Sources & remediation
Other references
Weakness type (CWE)
CWE-117
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
Threat summary
- 1 mentions across 1 observed day
What's happening
- 1 total mentions across 1 day