Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
Sources: National Vulnerability Database, CISA KEV, Exploit-DB
CVE-2026-109786 Overview
CVE-2026-109786 is a log injection vulnerability in fail2ban versions 0.10.5 through 1.1.1 (prior to commit ddd879d). The default sshd filter in config/filter.d/sshd.conf accepts an on <token> suffix after the host address. OpenSSH logs offered usernames verbatim, which allows a remote unauthenticated attacker to craft a username that fail2ban parses as a different source IP. The attacker can then force fail2ban to ban an arbitrary IP address, including those of legitimate users or critical infrastructure. The flaw is categorized under [CWE-117: Improper Output Neutralization for Logs].
Critical Impact
Remote unauthenticated attackers can abuse the sshd filter to ban arbitrary IP addresses, producing a targeted denial of service against legitimate users or services.
Affected Products
- fail2ban 0.10.5 through 1.1.1
- Deployments using the default sshd filter mode in filter.d/sshd.conf
- Any OpenSSH-protected host relying on fail2ban for brute-force protection prior to commit ddd879d
Discovery Timeline
- 2026-10-13 - CVE-2026-109786 published to NVD
- 2026-10-15 - Last updated in NVD database
Technical Details for CVE-2026-109786
Vulnerability Analysis
The vulnerability stems from how the fail2ban sshd filter parses OpenSSH authentication failure log lines. The filter's regular expressions accept an optional suffix pattern that includes on <token> after the host address. OpenSSH records the username offered by the client in its log messages without sanitization. An attacker can supply a username containing whitespace, a victim IP, and the token on, so the full log line fits the filter's pattern. fail2ban then extracts the attacker-supplied IP as the offending host and applies the ban action to that address.
Root Cause
The root cause is improper neutralization of attacker-controlled input embedded in log output ([CWE-117]). The regex in filter.d/sshd.conf was overly permissive, allowing the <HOST> capture group to match tokens that originated from the username field. Because the filter trusted the structure of the sshd log line without accounting for whitespace within the offered username, user-controlled text could shift the host anchor and cause fail2ban to misidentify the source IP.
Attack Vector
The attack vector is network-based and requires no authentication. The attacker initiates an SSH connection and submits a crafted username such as x VICTIM-SOURCE-IP-ADDRESS on. OpenSSH logs the attempt verbatim, including the malicious tokens. fail2ban processes the log, applies the vulnerable regex, and treats VICTIM-SOURCE-IP-ADDRESS as the source of the failed authentication. After enough crafted attempts, fail2ban reaches the ban threshold and inserts a firewall rule blocking the victim IP from reaching the SSH service or other protected ports.
# Patch excerpt: config/filter.d/sshd.conf
# optional prefix (logged from several ssh versions) like "error: ", "error: PAM: " or "fatal: "
__pref = (?:(?:error|fatal): (?:PAM: )?)?
# optional suffix (logged from several ssh versions) like " [preauth]"
-#__suff = (?: port \d+)?(?: \[preauth\])?\s*
-__suff = (?: (?:port \d+|on \S+|\[preauth\])){0,3}\s*
-__on_port_opt = (?: (?:port \d+|on \S+)){0,2}
+__on_port_opt = (?: port \d+)?
+__suff = %(__on_port_opt)s(?: \[preauth\])?\s*
+
# close by authenticating user (don't use <HOST> after %(__authng_user)s because of catch-all `.*?`):
__authng_user = (?: (?:by|from))?(?: (?:invalid|authenticating) user <F-USER>\S+|.*?</F-USER>)?(?: from)?
Source: GitHub Fail2Ban Commit ddd879d. The patch removes the permissive on \S+ alternative from the suffix regex, preventing attacker-controlled tokens from shifting the <HOST> match.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-109786
Indicators of Compromise
- Unexpected ban entries in fail2ban.log targeting IP addresses that belong to legitimate users, internal services, or upstream infrastructure.
- OpenSSH auth.log or sshd journal entries containing usernames with embedded whitespace, IP-like substrings, or the literal token on (for example, Invalid user x 203.0.113.5 on from <attacker-ip>).
- Spikes in iptables/nftables reject rules installed by fail2ban that do not correlate with observed authentication failures from the banned IP.
Detection Strategies
- Hunt in SSH authentication logs for the regex Invalid user .+ \d+\.\d+\.\d+\.\d+ on and alert on any match.
- Correlate fail2ban ban events against connection telemetry; a ban without matching inbound SSH flows from the banned IP indicates injection.
- Monitor commit state of filter.d/sshd.conf on managed hosts and flag deployments running fail2ban 0.10.5 through 1.1.1 without the ddd879d fix.
Monitoring Recommendations
- Centralize fail2ban.log and sshd logs into a SIEM to allow cross-source correlation of bans and authentication attempts.
- Alert when fail2ban bans an IP belonging to allowlisted ranges, VPN gateways, or administrative jump hosts.
- Track the rate of unique usernames per source IP; sustained submission of structured usernames with embedded IPs is anomalous.
How to Mitigate CVE-2026-109786
Immediate Actions Required
- Upgrade fail2ban to a release containing commit ddd879d or later, or apply the patched filter.d/sshd.conf manually.
- Audit current ban lists and remove entries that may correspond to injected IP addresses before legitimate users are impacted.
- Add critical infrastructure IPs (monitoring, VPN, management) to ignoreip in jail.conf to limit blast radius.
Patch Information
The fix is published in the fail2ban repository under commit ddd879d22664904ace24e1255ac6571808c58187. The patch rewrites __suff and __on_port_opt in filter.d/sshd.conf to accept only port \d+ and [preauth] after the host, closing the injection path. Operators who cannot upgrade immediately can backport the regex changes directly into their existing configuration.
Workarounds
- Replace the __suff and __on_port_opt definitions in filter.d/sshd.conf with the patched versions shown above.
- Set mode = normal with a stricter custom failregex that anchors <HOST> to end-of-line, rejecting any trailing tokens.
- Populate ignoreip with trusted network ranges so a successful injection cannot ban those addresses.
- Reduce ban duration (bantime) and raise findtime/maxretry thresholds to shrink the window of impact until patching is complete.
# /etc/fail2ban/jail.local - defensive configuration example
[DEFAULT]
ignoreip = 127.0.0.1/8 10.0.0.0/8 192.168.0.0/16 203.0.113.0/24
bantime = 10m
findtime = 10m
maxretry = 5
[sshd]
enabled = true
mode = normal
filter = sshd
# After upgrading or backporting the ddd879d patch to filter.d/sshd.conf
logpath = /var/log/auth.log
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
Sources: National Vulnerability Database, CISA KEV, Exploit-DB
