CVE-2026-48113

Name of the Vulnerable Software and Affected Versions chisel (affected versions not specified)

Description Authenticated clients can bypass Access Control List (ACL) restrictions defined via the --authfile parameter to tunnel traffic to arbitrary destinations reachable from the server. While the server validates ACLs during the initial configuration handshake, it fails to perform these checks when processing subsequent SSH channels that carry actual traffic. A malicious authenticated client can pass the initial handshake using a permitted remote and then open channels to any host:port by manipulating the ExtraData field in the SSH channel request. This occurs because the user context is not propagated to the tunnel layer, and the handleSSHChannel() function accepts channels unconditionally before passing the client-controlled destination to the handleTCP() function, which dials the target without further validation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.