CVE-2026-81535: wolfSSH Unauthorized Forwarded-TCPIP Channel Opens

CVE-2026-81535 is a missing-authorization bug in wolfSSH, a lightweight embedded SSH library commonly used in firmware and IoT builds, where forwarded-tcpip channel opens skip the forwarding policy check that direct-tcpip opens go through, letting a malicious SSH peer force unbounded buffer allocation per forwarding channel and, on the client side, open forwarding channels to addresses the client never asked for.

CVE-2026-81535 (CWE-862 Missing Authorization, CWE-863 Incorrect Authorization) affects wolfSSH, wolfSSL's lightweight SSH client/server/library commonly embedded in resource-constrained firmware and IoT builds. NVD's description states: "In wolfSSH through 1.5.0 built with --enable-fwd, DoChannelOpen() in src/internal.c gates only direct-tcpip channel opens with the forwarding policy callback. forwarded-tcpip opens are admitted without an authorization check and are not capped in number, allowing a malicious SSH peer to make an endpoint allocate unbounded per-channel buffers for forwarding channels the application never authorized. A client also does not check a forwarded-tcpip open against the forwards it registered with a tcpip-forward request, as RFC 4254 section 7.2 requires, so a malicious server can open forwarding channels for addresses and ports the client never asked it to forward" (NVD).

NVD's own analysis assigns a Primary CVSS v3.1 base score of 9.1 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N — network-reachable, low complexity, no privileges or user interaction, high confidentiality and integrity impact via unauthorized forwarding paths, no direct availability impact in NVD's own scoring. wolfSSL's own CNA submission (sourceIdentifier [email protected]) separately rates it CVSS v4.0 6.3, vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/... — a materially lower rating that treats the impact as limited availability degradation rather than confidentiality/integrity loss. The GitHub Advisory Database lists the same two scores but classifies the overall severity as "medium" and marks the advisory unreviewed, i.e. not yet triaged by GitHub's own security team (GitHub Advisory Database GHSA-cqr9-f685-gr3w).

wolfSSL fixed the issue with three commits to the wolfssh repository, tagged for release 1.6.0. The primary fix commit's message states the root cause plainly: "forwarded-tcpip was never gated; fell through to default-accept channelOpenCb," and the fix "require[s] fwdCb for both forwarding channel types, failing closed without it" and "reject[s] server-side forwarded-tcpip opens before any policy hook runs," tracked internally as issue F-6275 (wolfSSL/wolfssh commit 616eb68). The fix is included in the v1.6.0-stable tag; prior tags (v1.5.0-stable and earlier) are vulnerable when built with --enable-fwd (wolfSSL/wolfssh GitHub tags).

As of 2026-10-30, FIRST scores the probability of exploitation at 0.00305 (23.0th percentile) (FIRST EPSS). CVE-2026-81535 is not currently listed in the CISA Known Exploited Vulnerabilities catalog (checked against the live KEV feed, catalog version 2026.10.30, 1766 entries).

Any firmware or embedded product that links wolfSSH built with SSH port forwarding enabled (--enable-fwd) should upgrade to 1.6.0 or later; because wolfSSH ships as source to be compiled into vendor firmware rather than as a standalone update, device makers — not end users — are the ones who need to pull in the fix and rebuild.

• wolfSSH through 1.5.0 built with --enable-fwd admits forwarded-tcpip channel opens without the forwarding policy check applied to direct-tcpip opens, with no cap on count, letting a malicious SSH peer force unbounded per-channel buffer allocation; a client also fails to validate forwarded-tcpip opens against its own registered forwards per RFC 4254 §7.2. — NVD
• NVD Primary CVSS v3.1 base score is 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N); wolfSSL's own CNA CVSS v4.0 submission scores it 6.3 with a lower-impact vector; GitHub Advisory Database lists severity as "medium" and the advisory as unreviewed. — GitHub Advisory Database
• Fix commit states forwarded-tcpip was never gated and fell through to default-accept; the fix requires the forwarding policy callback for both forwarding channel types and rejects server-side forwarded-tcpip opens before any policy hook runs (issue F-6275). Fix is in the v1.6.0-stable tag. — wolfSSL/wolfssh GitHub
• EPSS score is 0.00305 (23.0th percentile) as of 2026-10-30; not present in the live CISA KEV feed (catalog version 2026.10.30, 1766 entries) checked by exact cveID match. — FIRST EPSS