CVE-2026-48113: Chisel ACL Bypass Vulnerability

CVE-2026-48113 Overview

CVE-2026-48113 is an authorization bypass vulnerability in Chisel, a TCP/UDP tunnel transported over HTTP and secured via SSH. In versions prior to 1.11.5, authenticated clients can bypass --authfile access control list (ACL) restrictions and tunnel traffic to arbitrary destinations reachable from the server. The ACL is enforced only during the initial handshake against declared remotes but never on subsequent SSH channels that carry actual traffic. An authenticated client can declare a permitted remote to pass the handshake, then open new channels to any host:port reachable from the Chisel server. The issue is tracked under CWE-863: Incorrect Authorization and fixed in version 1.11.5.

Critical Impact
Authenticated Chisel clients can pivot to arbitrary internal hosts and ports, bypassing ACL restrictions intended to limit tunnel destinations.

Affected Products

Chisel versions prior to 1.11.5
Deployments using --authfile to restrict client remotes
Chisel servers exposing internal network segments through tunnels

Discovery Timeline

2026-08-03 - CVE-2026-48113 published to the National Vulnerability Database (NVD)
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2026-48113

Vulnerability Analysis

Chisel authenticates clients using an --authfile that maps user credentials to allowed remotes expressed as host:port patterns. When a client connects, the server validates that each remote declared in the initial configuration matches the ACL for that user. Once the SSH transport is established, the client can open additional SSH channels to request outbound connections. The server accepts those channel-open requests and dials the requested destination without consulting the ACL again.

The result is a check-once-use-many authorization gap. A client authenticates with an allowed remote, satisfies the handshake, then opens tunnel channels targeting arbitrary destinations. Because Chisel is frequently deployed to bridge network segments or expose bastion-style access, the bypass lets an attacker reach any host and port routable from the server, including internal services intended to be off-limits to that user.

Root Cause

The ACL enforcement lived only in the handshake path. In server/server_handler.go, the tunnel was constructed without an ACL callback, so the per-channel dialer in share/tunnel/tunnel.go had no way to reject destinations. The tunnel.Config struct did not expose an authorization hook, leaving outbound channel dials unchecked.

Attack Vector

An authenticated user connects to a vulnerable Chisel server with a valid remote allowed by the ACL. After the transport is established, the client issues SSH channel-open requests referencing arbitrary host:port targets. The server dials each requested target and proxies traffic, giving the client tunnel access far beyond the configured remote list.

// Source: https://github.com/jpillora/chisel/commit/44310b65667a97901874ffdf4815b3732c22eaa3
// Patch in server/server_handler.go - Enforce auth ACL on tunnel channels

//successfuly validated config!
r.Reply(true, nil)
//tunnel per ssh connection
tunnelConfig := tunnel.Config{
    Logger:    l,
    Inbound:   s.config.Reverse,
    Outbound:  true, //server always accepts outbound
    Socks:     s.config.Socks5,
    KeepAlive: s.config.KeepAlive,
}
//enforce ACL on every channel, not just the initial config
if user != nil {
    tunnelConfig.ACL = user.HasAccess
}
tunnel := tunnel.New(tunnelConfig)

The companion change in share/tunnel/tunnel.go adds the ACL hook to the tunnel configuration so every outbound channel is checked:

// Source: https://github.com/jpillora/chisel/commit/44310b65667a97901874ffdf4815b3732c22eaa3
// Patch in share/tunnel/tunnel.go

Outbound  bool
Socks     bool
KeepAlive time.Duration
//ACL optionally checks if a given address (host:port) is allowed.
//When set, outbound connections are denied if this returns false.
ACL func(addr string) bool

Detection Methods for CVE-2026-48113

Indicators of Compromise

Chisel server logs showing tunnel channels to host:port destinations that do not appear in any user's --authfile entry
Outbound connections from a Chisel server process to internal services outside its documented scope
Long-lived Chisel sessions from a single authenticated user opening large numbers of distinct destination channels

Detection Strategies

Inventory all Chisel deployments and record the running version; flag any instance below 1.11.5
Compare Chisel server connection logs against the configured --authfile remotes and alert on destinations outside the allow list
Monitor network flows originating from Chisel server hosts and correlate with expected tunnel destinations

Monitoring Recommendations

Enable verbose logging on Chisel servers and forward logs to a central SIEM for correlation with network telemetry
Baseline expected destination host:port pairs per authenticated Chisel user and alert on deviations
Restrict egress from Chisel server hosts using host or network firewalls so unauthorized destinations are blocked at the perimeter

How to Mitigate CVE-2026-48113

Immediate Actions Required

Upgrade all Chisel servers to version 1.11.5 or later, which enforces the ACL on every SSH channel
Audit --authfile entries and remove users or remotes that are no longer required
Review Chisel server logs and network flow records for tunnel destinations outside the intended ACL scope

Patch Information

The fix is available in Chisel 1.11.5. See the GitHub Security Advisory GHSA-24fp-5v3p-rvpw and the upstream commit 44310b6 for the code changes that introduce the per-channel ACL check.

Workarounds

Place the Chisel server behind a network egress policy that only permits connections to sanctioned internal destinations
Terminate Chisel on a segmented host with no routable path to sensitive services until the patched release is deployed
Rotate credentials in --authfile and reissue only to trusted users after upgrading

bash

# Upgrade example - fetch and install patched Chisel binary
curl -L https://github.com/jpillora/chisel/releases/download/v1.11.5/chisel_1.11.5_linux_amd64.gz -o chisel.gz
gunzip chisel.gz && chmod +x chisel
./chisel --version   # confirm 1.11.5 or later