CVE-2026-67276: RouterOS SSH Authentication Bypass Vulnerability

CVE-2026-67276 Overview

CVE-2026-67276 is an authentication bypass in MikroTik RouterOS SSH that allows an attacker to log in as an authorized user without possessing the corresponding private key. RouterOS compares only the key type and RSA modulus when matching an incoming public key against the authorized keys list, ignoring the exponent. An attacker who learns any authorized RSA modulus can present a crafted key with exponent one, forge a valid signature, and open an SSH command channel as the target account. The flaw is tracked under [CWE-347: Improper Verification of Cryptographic Signature] and affects the RouterOS 7.x branch.

Critical Impact
Remote, unauthenticated attackers who obtain a public RSA modulus can hijack SSH sessions as any authorized user, gaining full command-line control of the router.

Affected Products

MikroTik RouterOS 7.x branch prior to 7.23.4 (Long-term)
MikroTik RouterOS 7.x branch prior to 7.24.2 (Stable)
Devices with SSH public key authentication enabled for administrative users

Discovery Timeline

2026-09-05 - CVE-2026-67276 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-67276

Vulnerability Analysis

RouterOS matches an incoming SSH public key to an authorized key by comparing only the algorithm identifier and the RSA modulus n. The public exponent e is excluded from the comparison. Signature verification then uses the client-supplied key material rather than the stored authorized key. This split between matching and verification breaks the trust model of SSH public key authentication.

Because the exponent is part of the signature verification math, an attacker who substitutes a different exponent effectively defines a new key pair for which they know the private key. The router still accepts the session because the modulus matches an authorized entry. The result is a full pre-authentication bypass over the network against RouterOS SSH.

Root Cause

The root cause is an incomplete public key equality check inside the SSH authentication path. RSA public keys are defined by the tuple (n, e), and any correct comparison must include both values. RouterOS truncated the check to (type, n), violating the invariant assumed by the downstream signature verifier. This is a textbook [CWE-347] signature verification flaw.

Attack Vector

The attack requires network reachability to the SSH service and knowledge of an authorized user's RSA modulus. Moduli are not secrets and can be harvested from public key material exposed on GitHub, backup archives, configuration exports, or previously logged authentication attempts. The attacker constructs an RSA public key with the same modulus but sets the exponent e = 1. With e = 1, signing degenerates to s = m mod n, so the attacker can compute a valid signature over the SSH authentication payload without the private key. RouterOS accepts the signature and opens a command channel as the target user.

See the NPratley analysis of the RouterOS 7.23.4 fix and the CERT.pl advisory for reverse-engineering details.

Detection Methods for CVE-2026-67276

Indicators of Compromise

SSH authentication events for administrative accounts originating from unexpected source IPs or ASNs.
New RouterOS configuration changes, user additions, or scheduler scripts created shortly after an SSH login.
Outbound tunnels, VPN peers, or firewall rules added without a corresponding change ticket.
SSH sessions where the offered RSA public key uses an exponent of 1 instead of the standard 65537.

Detection Strategies

Capture SSH handshakes at the network edge and flag any RSA public key whose exponent field equals 1.
Correlate successful SSH logins to RouterOS devices against expected administrator source addresses and jump hosts.
Alert on RouterOS log entries showing public key authentication success followed by immediate configuration export or user creation.

Monitoring Recommendations

Forward RouterOS syslog to a central data lake and retain SSH authentication and configuration change events.
Baseline the set of RSA public keys authorized on each device and alert on drift.
Monitor for scans against TCP/22 targeting MikroTik banners across the perimeter.

How to Mitigate CVE-2026-67276

Immediate Actions Required

Upgrade RouterOS 7.x devices to 7.23.4 (Long-term) or 7.24.2 (Stable) per the MikroTik September 2026 advisory.
Restrict SSH management access to trusted management networks using the RouterOS firewall input chain.
Rotate all RSA keys used for RouterOS SSH authentication after patching, since existing moduli may already be known to attackers.
Audit each device for unauthorized users, scripts, schedulers, and firewall rules added during the exposure window.

Patch Information

MikroTik released fixed builds 7.23.4 (Long-term) and 7.24.2 (Stable). Release details are available in the 7.23.4 Long-term and 7.24.2 Stable forum announcements. CERT.pl reports active exploitation of MikroTik RouterOS vulnerabilities in its follow-up report, so patching is time-sensitive.

Workarounds

Disable SSH public key authentication for administrative users until the device is upgraded.
Bind the SSH service to a management VRF or loopback reachable only over VPN.
Enforce address lists on the SSH service so only known administrator IPs can connect.
Temporarily disable the SSH service on devices that can be managed through Winbox or the console.

bash

# Configuration example: restrict SSH to a trusted management subnet
/ip firewall filter add chain=input protocol=tcp dst-port=22 \
    src-address=203.0.113.0/24 action=accept comment="Mgmt SSH"
/ip firewall filter add chain=input protocol=tcp dst-port=22 \
    action=drop comment="Block all other SSH"

# Optional: disable SSH public key auth until patched
/user ssh-keys print
/user ssh-keys remove [find]