CVE-2026-16516: wolfSSH Authentication Bypass Vulnerability

CVE-2026-16516 Overview

CVE-2026-16516 affects wolfSSH, where the client fails to validate that the Elliptic Curve Digital Signature Algorithm (ECDSA) curve identifier in a KEXDH_REPLY host key blob matches the algorithm negotiated during key exchange. An active network man-in-the-middle (MitM) attacker can substitute a host key blob containing a different ECDSA curve. The client then imports the key on the wrong curve, and because the attacker controls the private key for the substituted curve, signature verification succeeds. This weakness is categorized under [CWE-345: Insufficient Verification of Data Authenticity].

Critical Impact
Active MitM attackers can impersonate SSH servers to wolfSSH clients that use lax public key verification callbacks, breaking the integrity guarantees of the SSH transport layer.

Affected Products

wolfSSH (client-side implementations prior to the patch in commit 31d13697)
Applications linking wolfSSH with ECDSA host key support enabled (WOLFSSH_NO_ECDSA not defined)
Deployments relying on Trust On First Use (TOFU), algorithm-name-only checks, or fingerprint matching against the parsed key

Discovery Timeline

2026-10-07 - CVE CVE-2026-16516 published to NVD
2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-16516

Vulnerability Analysis

The flaw resides in ParseECCPubKey() within src/internal.c. During the SSH key exchange, the server sends a host key blob whose algorithm string is parsed to derive the elliptic curve via NameToId and wcPrimeForId. The parsed algorithm string is never cross-checked against ssh->handshake->pubKeyId, which holds the algorithm negotiated earlier in the handshake.

Additionally, the RFC 5656 curve identifier string embedded in the blob is skipped using GetSkip() rather than compared against the negotiated curve. This decoupling of negotiation and parsing enables curve confusion, where the client imports a point onto an attacker-chosen curve.

Root Cause

The root cause is missing authenticity verification between negotiated parameters and received key material. wolfSSH trusts the algorithm string embedded in the host key blob rather than enforcing the algorithm selected during KEX negotiation. This violates the binding that SSH requires between the negotiated host key algorithm and the key presented by the server.

Attack Vector

An attacker in an active MitM position intercepts the KEXDH_REPLY message and replaces the host key blob with one encoding a different ECDSA curve controlled by the attacker. The client parses the substituted blob, derives the wrong curve, and successfully verifies the attacker's signature. Exploitation requires both an active MitM position and a permissive public key check callback, such as TOFU, algorithm-name-only validation, or a fingerprint check performed on the parsed key.

     const byte* q;
     word32 qSz, pubKeyIdx = 0;
     int primeId = 0;
+    const char* algoName;
+    const char* curveName;
 
     ret = wc_ecc_init_ex(&sigKeyBlock_ptr->sk.ecc.key, ssh->ctx->heap,
                                  INVALID_DEVID);
// Source: https://github.com/wolfSSL/wolfssh/commit/31d13697a608fa1bf9eec11aa6eff1503ade836f

The patch introduces explicit algoName and curveName variables so ParseECCPubKey() can compare the blob's algorithm and RFC 5656 curve identifier against the negotiated pubKeyId before importing the key.

Detection Methods for CVE-2026-16516

Indicators of Compromise

Unexpected SSH host key algorithm mismatches logged by wolfSSH clients during handshake.
SSH sessions where the server-advertised host key algorithm differs from previously known server fingerprints.
Anomalous ECDSA curves (for example, nistp384 or nistp521) appearing when nistp256 was previously used by a server.

Detection Strategies

Instrument wolfSSH client builds to log ssh->handshake->pubKeyId alongside the parsed algorithm string from ParseECCPubKey().
Correlate SSH client telemetry against expected host key algorithms per destination server.
Monitor network traffic for repeated SSH handshake failures or renegotiations that could indicate MitM probing.

Monitoring Recommendations

Capture and inspect SSH KEXDH_REPLY packets at network egress points to validate host key consistency.
Alert on changes to known-good host key fingerprints for critical SSH endpoints.
Review application logs from wolfSSH-linked clients for unexpected key import successes following algorithm mismatch warnings.

How to Mitigate CVE-2026-16516

Immediate Actions Required

Rebuild and redistribute wolfSSH-dependent clients with the fix from commit 31d13697a608fa1bf9eec11aa6eff1503ade836f applied.
Audit all public key check callbacks and replace TOFU or algorithm-name-only validation with strict fingerprint pinning that includes curve identity.
Rotate any ECDSA host keys that may have been exposed to confused clients and reissue trusted fingerprints to operators.

Patch Information

The upstream fix is available in the wolfSSL/wolfssh repository. See the GitHub Commit Details and the GitHub Issue Discussion for the full remediation and test harness additions, including the new wolfSSH_TestParseECCPubKey helper for regression testing.

Workarounds

Disable ECDSA host key support in wolfSSH builds by defining WOLFSSH_NO_ECDSA where feasible, falling back to RSA or Ed25519 host keys.
Enforce strict host key verification callbacks that validate both the raw public key bytes and the negotiated algorithm, rejecting any mismatch.
Restrict SSH client connectivity to trusted network paths to reduce exposure to active MitM attackers until the patch is deployed.

bash

# Build wolfSSH without ECDSA support as a temporary mitigation
./configure CFLAGS="-DWOLFSSH_NO_ECDSA"
make && sudo make install