CVE-2026-48851: Putty Authentication Bypass Vulnerability

CVE-2026-48851 Overview

CVE-2026-48851 is a user interface confusion vulnerability in PuTTY versions 0.77 through 0.83. PuTTY uses a copy of its icon as a trust sigil to mark TELNET data originating from the client rather than from a remote server. The trust status is not cleared between proxy authentication and the main session. An attacker controlling a malicious proxy can present crafted content during proxy authentication that retains the trust indicator after the main session begins, misleading users into accepting spoofed prompts as legitimate client output. This issue is tracked under CWE-451: User Interface (UI) Misrepresentation of Critical Information.

Critical Impact
A malicious proxy can spoof trusted client UI elements during a TELNET session, potentially tricking users into disclosing credentials or accepting attacker-controlled data as locally trusted.

Affected Products

PuTTY 0.77 through 0.83
TELNET sessions routed through proxy authentication
All platforms shipping the affected PuTTY builds

Discovery Timeline

2026-05-25 - CVE-2026-48851 published to the National Vulnerability Database (NVD)
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-48851

Vulnerability Analysis

PuTTY embeds a trust sigil, rendered as a copy of the PuTTY icon, into TELNET data streams to distinguish locally generated client text from data sent by the remote server. This sigil helps users recognize authentic password prompts and avoid spoofed prompts injected by a hostile server. The vulnerability arises because PuTTY does not reset the trust status when the connection transitions from proxy authentication to the main TELNET session. Content displayed during proxy authentication therefore inherits the same trust marking used for legitimate client output. A malicious proxy server can exploit this lapse to render attacker-controlled text that appears to originate from PuTTY itself.

Root Cause

The defect is a state management flaw in PuTTY's trust sigil handling logic. The trust flag governing whether output is marked with the trusted icon persists across the proxy-to-session boundary. PuTTY treats data from the proxy phase and the main session as a continuous trusted context, violating the security assumption that only locally generated text deserves the sigil.

Attack Vector

Exploitation requires a network-positioned attacker operating or compromising a proxy that the victim configures PuTTY to use for a TELNET session. The attacker delivers crafted bytes during proxy authentication that survive into the main session display with the trust marker intact. User interaction is required because the victim must initiate the connection and respond to the spoofed prompt. The attack does not yield code execution or data confidentiality loss directly but enables credential phishing through UI deception.

No verified proof-of-concept code is published. See the Chiark PuTTY wishlist entry for the maintainer's technical write-up.

Detection Methods for CVE-2026-48851

Indicators of Compromise

Outbound TELNET sessions from endpoints running PuTTY versions 0.77 through 0.83 routed through untrusted or unexpected proxies
Proxy authentication traffic containing unusual byte sequences that resemble PuTTY trust sigil control data
User reports of unexpected credential prompts appearing immediately after proxy connection establishment

Detection Strategies

Inventory installed PuTTY versions across the environment and flag any instance reporting a version between 0.77 and 0.83
Alert on TELNET (TCP/23) traffic from corporate endpoints, which should be rare in modern networks and warrants review regardless of this CVE
Correlate proxy configuration changes in PuTTY session files with subsequent TELNET connection attempts

Monitoring Recommendations

Log PuTTY executable hashes and versions through endpoint software inventory tools
Monitor for cleartext TELNET sessions and proxy CONNECT requests originating from user workstations
Review proxy server access logs for clients negotiating PuTTY-style TELNET sessions

How to Mitigate CVE-2026-48851

Immediate Actions Required

Upgrade PuTTY to version 0.84 or later on all managed endpoints
Replace TELNET usage with SSH wherever the protocol is still in service
Restrict outbound TELNET traffic at egress firewalls until upgrades are confirmed

Patch Information

The PuTTY maintainers fixed the issue in version 0.84. The release announcement is available in the Tartarus PuTTY announcement archive. The maintainer's tracking entry for the underlying design defect is documented at the Chiark PuTTY wishlist item.

Workarounds

Avoid configuring PuTTY to use proxy authentication for TELNET sessions until patched
Disable TELNET in favor of SSH, which is not affected by this trust sigil flaw
Train users to treat any credential prompt appearing during or immediately after proxy negotiation as suspicious

bash

# Verify the installed PuTTY version on Windows
(Get-Item "C:\Program Files\PuTTY\putty.exe").VersionInfo.ProductVersion

# Block outbound TELNET at a Windows host firewall until PuTTY is upgraded
New-NetFirewallRule -DisplayName "Block Outbound TELNET" -Direction Outbound -Protocol TCP -RemotePort 23 -Action Block