CVE-2026-109786
Summary
| CVE | CVE-2026-109786 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-10-13 03:16:40 UTC |
| Updated | 2026-10-16 19:55:59 UTC |
| Description | In fail2ban 0.10.5 through 1.1.1 before ddd879d, the sshd filter (config/filter.d/sshd.conf) accepts an "on <token>" suffix after the host address. Because OpenSSH logs the offered username verbatim, a remote unauthenticated attacker can use a username such as "x VICTIM-SOURCE-IP-ADDRESS on" to make fail2ban associate failed login attempts with an arbitrary source IP address and ban it (e.g., to block logins from a legitimate user). The default filter mode is affected. |
Risk And Classification
Primary CVSS: v3.1 5.3 MEDIUM from [email protected]
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
EPSS: 0.003140000 probability, percentile 0.227390000 (date 2026-10-16)
Problem Types: CWE-117 | CWE-117 CWE-117 Improper Output Neutralization for Logs
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Secondary | 5.3 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
| 3.1 | CNA | CVSS | 5.3 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
NoneUser Interaction
NoneScope
UnchangedConfidentiality
NoneIntegrity
NoneAvailability
LowCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| coredump.ws/repos/mail-hardening.git | [email protected] | coredump.ws | |
| github.com/fail2ban/fail2ban/commit/ddd879d22664904ace24e1255ac6571808c5... | [email protected] | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Additional Advisory Data
Solutions
CNA: Apply upstream commit ddd879d22664904ace24e1255ac6571808c58187, or upgrade to the first fail2ban release after 1.1.1 that contains it.
Workarounds
CNA: Override __on_port_opt and __suff in a local filter.d/sshd.local so that only an optional "port N" may follow the host address, as in the upstream fix: __on_port_opt = (?: port \d+)? and __suff = %(__on_port_opt)s(?: \[preauth\])?\s*. Add the administrator's own addresses to ignoreip.
There are currently no legacy QID mappings associated with this CVE.