Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Froxlor before 2.3.12 fails to properly validate multi-line SSH public keys in the SshKeys::add() endpoint, allowing customers to inject arbitrary lines into authorized_keys files. Attackers can inject malicious SSH key entries with option directives to gain persistent unauthorized access that survives key deletion and SSH access revocation.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
Operators treat panel delete like it cleared SSH access. Froxlor CVE-2026-90767 lets a customer inject authorized_keys lines via a newline in the pubkey field. Anything without froxlor:id= stays after the UI remove. Get to 2.3.12. https://nvd.nist.gov/vuln/detail/CVE-2026-90767
Post summary
The tweet discloses CVE-2026-90767 in Froxlor, details the unauthorized_keys injection flaw, and urges upgrading to version 2.3.12 as a patch.