CVE-2026-48113

CVE-2026-48113 in Chisel is an access control bypass where ACLs are enforced only at SSH handshake time, but the protocol allows authenticated connections to spawn arbitrary channels afterward. When a client authenticates, Chisel checks which remote destinations that user is permitted to reach—but once authenticated, any channel request on that connection is implicitly authorized. An attacker who legitimately connects to a Chisel server with access to one port can spawn channels to any other port, bypassing the ACL entirely. The vulnerability exists because the developer modeled access control against the connection lifecycle while SSH operates at a channel lifecycle. The SSH protocol treats an authenticated connection as implicitly authorized to create channels—it does not re-present identity or re-validate permissions at channel creation time. This is a fundamental mismatch: the access control check happens once, at the wrong layer. If you're running Chisel, upgrade to 1.11.5 immediately. For defense-in-depth, audit your existing Chisel deployments: check what remotes are exposed, verify which users have ACL entries, and confirm that untrusted users cannot reach internal services that should be restricted. The fix adds per-channel validation, but until you've patched, treat any Chisel instance with user-facing ACLs as potentially exposing more surface than intended. The deeper lesson is that SSH tunnel tools require explicit modeling of post-auth channel lifecycle in threat models. This is not a one-off bug—frp, ngrok, and other self-hosted tunnel tools have surfaced the same class of vulnerability. When implementing ACLs for any SSH-multiplexed protocol, enforcement must happen at channel creation, not at handshake. The protocol provides no primitives to constrain channel creation post-authentication; you must add external enforcement.

Reviewed through automated stages and approved by a human before publication.