CVE-2026-86231: mwiede jsch Certificate Revocation RCE

CVE-2026-86231 Overview

CVE-2026-86231 affects mwiede JSch versions up to 2.28.5, a Java implementation of SSH2. The flaw resides in the getRevokedKeys function within src/main/java/com/jcraft/jsch/KnownHosts.java. The library fails to properly parse certificate-form revoked host keys, resulting in an improper check for certificate revocation [CWE-298]. An attacker with the ability to influence the known_hosts file contents can bypass revocation validation. The issue is fixed in JSch 2.28.6 through commit 194a2f76a5c0f1c3f778565be3fd66bcafc42d23.

Critical Impact
Applications relying on JSch certificate revocation entries may accept SSH host keys that should be treated as revoked, undermining trust decisions for SSH connections.

Affected Products

mwiede JSch versions up to and including 2.28.5
Java applications embedding the com.jcraft.jsch package for SSH client functionality
Downstream tools and libraries bundling vulnerable JSch releases

Discovery Timeline

2026-09-06 - CVE-2026-86231 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86231

Vulnerability Analysis

JSch uses OpenSSH-style known_hosts entries to validate SSH server identities. Entries can be prefixed with markers such as @revoked to indicate a host key must not be trusted. The getRevokedKeys method in KnownHosts.java parses these entries and returns the set of revoked keys used during connection verification.

The pre-patch parser only recognized standard host key types when reading the key type token. Certificate host key types, such as those produced by OpenSSH certificate authorities, were treated as unknown and effectively discarded. As a result, @revoked entries expressed in certificate form were silently ignored during revocation checks.

Exploitation requires an attacker to induce a client to connect to a server presenting a certificate-based host key that an administrator previously listed as revoked. Because the revoked entry is not parsed, JSch treats the host key as valid.

Root Cause

The root cause is missing recognition of OpenSSH certificate key types in the known_hosts parser. When HostKey.name2type(tmp) returned UNKNOWN, the parser skipped the entry without considering the @revoked marker, so certificate-form revocation entries never populated the revoked key set.

Attack Vector

The attack is remote and considered high complexity. It targets the integrity of host authentication decisions rather than confidentiality or availability. Successful exploitation requires an adversary positioned to present the specific revoked certificate host key that the client attempted to blacklist.

java

         }
 
         sb.setLength(0);
-        type = -1;
         while (j < bufl) {
           i = buf[j++];
           if (i == 0x20 || i == '\t') {
             break;
           }
           sb.append((char) i);
         }
-        String tmp = sb.toString();
-        if (HostKey.name2type(tmp) != HostKey.UNKNOWN) {
-          type = HostKey.name2type(tmp);
-        } else {
+        String keyType = sb.toString();
+        boolean revokedCertificate =
+            "@revoked".equals(marker) && OpenSshCertificateKeyTypes.isCertificateKeyType(keyType);
+        type = HostKey.name2type(keyType);
+        if (type == HostKey.UNKNOWN && !revokedCertificate) {
           j = bufl;
         }
         if (j >= bufl) {

Source: GitHub Commit 194a2f76. The patch introduces OpenSshCertificateKeyTypes.isCertificateKeyType(keyType) so that @revoked markers paired with certificate key types are retained rather than skipped.

Detection Methods for CVE-2026-86231

Indicators of Compromise

Successful SSH connections from applications using JSch to hosts whose certificate keys appear in @revoked entries of known_hosts.
Application dependency manifests referencing com.github.mwiede:jsch at versions <= 2.28.5.
Absence of parsing warnings when JSch loads known_hosts files containing certificate-form revocation entries.

Detection Strategies

Inventory Java build artifacts and container images for the jsch JAR and compare versions against the fixed release 2.28.6.
Perform Software Composition Analysis (SCA) scans against source repositories and CI pipelines to flag vulnerable JSch coordinates.
Instrument SSH client wrappers to log the parsed revoked key set and compare against the raw known_hosts contents to detect silently dropped entries.

Monitoring Recommendations

Alert on outbound SSH connections initiated by Java processes to hosts whose administrators have published certificate revocation entries.
Track application logs for host key acceptance events that should have matched a revoked certificate.
Monitor dependency update pipelines to confirm JSch is upgraded and rebuilt across all downstream consumers.

How to Mitigate CVE-2026-86231

Immediate Actions Required

Upgrade all applications and services embedding JSch to version 2.28.6 or later.
Rebuild and redeploy any container images, uber-JARs, or shaded artifacts that bundle the vulnerable JSch classes.
Audit known_hosts files distributed to clients and confirm certificate-form @revoked entries are enforced after the upgrade.

Patch Information

The fix is delivered in JSch 2.28.6 via commit 194a2f76a5c0f1c3f778565be3fd66bcafc42d23. Additional context is available in the GitHub Issue 1091 and Pull Request 1098. Vulnerability metadata is tracked at VulDB CVE-2026-86231.

Workarounds

Replace certificate-form @revoked entries with equivalent plain public key @revoked entries that the vulnerable parser recognizes.
Restrict SSH connectivity from Java applications to a curated allow-list of trusted host key fingerprints validated out-of-band.
Implement application-level host key verification callbacks that consult an external revocation source instead of relying solely on JSch parsing.

bash

# Maven dependency example: upgrade JSch to the patched release
# pom.xml
# <dependency>
#   <groupId>com.github.mwiede</groupId>
#   <artifactId>jsch</artifactId>
#   <version>2.28.6</version>
# </dependency>
mvn versions:set-property -Dproperty=jsch.version -DnewVersion=2.28.6
mvn -U clean verify