CVE-2026-90767: Froxlor SSH Key Injection Vulnerability

CVE-2026-90767 Overview

CVE-2026-90767 is a high-severity SSH key injection vulnerability in Froxlor, an open-source server administration panel. Versions before 2.3.12 fail to validate multi-line SSH public keys submitted through the SshKeys::add() API endpoint. Authenticated customers can inject arbitrary lines into authorized_keys files, including malicious key entries with SSH option directives. The injected entries survive key deletion and SSH access revocation, granting persistent unauthorized access to affected systems. The vulnerability is classified as improper neutralization of CRLF sequences [CWE-93].

Critical Impact
Authenticated Froxlor customers can inject persistent backdoor SSH keys that survive administrative revocation, enabling long-term unauthorized shell access to hosted systems.

Affected Products

Froxlor server administration panel versions prior to 2.3.12
Froxlor SshKeys API endpoint (lib/Froxlor/Api/Commands/SshKeys.php)
Froxlor SshKeys cron job (lib/Froxlor/Cron/System/SshKeys.php)

Discovery Timeline

2026-09-13 - CVE-2026-90767 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-90767

Vulnerability Analysis

Froxlor exposes an API endpoint that accepts SSH public keys from authenticated customers and writes them to the corresponding user's authorized_keys file. The SshKeys::add() function does not enforce that submitted keys are single-line values. An attacker can embed newline characters within the submitted key payload, causing multiple independent entries to be written to authorized_keys during the next cron synchronization.

Because OpenSSH treats each line of authorized_keys as a distinct entry, injected lines are honored as independent authorized keys. Attackers can attach SSH option directives such as command=, no-pty, or from= to injected entries. The result is a persistence primitive that is not tracked by Froxlor's UI and therefore not removed when an administrator deletes the visible key or revokes SSH access.

Root Cause

The root cause is CRLF neutralization failure [CWE-93] in the SSH key intake path. Froxlor accepts arbitrary key strings without stripping or rejecting embedded line terminators. Trust in the input format is assumed but never validated against the single-line structure that OpenSSH expects for authorized_keys entries.

Attack Vector

Exploitation requires authenticated access as a Froxlor customer with SSH key management privileges. The attacker submits a crafted key value containing newline characters and secondary key entries through the SshKeys::add() endpoint. When the Froxlor SSH cron job synchronizes keys to disk, all injected lines are written to the target authorized_keys file. The attacker retains access even after visible keys are removed through the panel.

No verified public exploit code is available. See the GitHub Security Advisory GHSA-p3v3-74gc-jh5f and the VulnCheck Advisory for further technical details.

Detection Methods for CVE-2026-90767

Indicators of Compromise

Multiple SSH key entries in a user's authorized_keys file that do not correspond to keys visible in the Froxlor administration panel.
Presence of SSH option directives such as command=, from=, or environment= prepended to entries in customer authorized_keys files.
Unexpected SSH login sessions from customer accounts after their SSH access was revoked or their keys deleted through Froxlor.

Detection Strategies

Compare the SSH keys stored in the Froxlor database against the actual contents of each customer's authorized_keys file and flag any discrepancies.
Audit authorized_keys files across managed systems for lines containing SSH option directives, which are uncommon in customer-managed keys.
Review Froxlor API request logs for SshKeys.add calls containing encoded newline characters (%0a, \n) in the key parameter.

Monitoring Recommendations

Enable SSH authentication logging (LogLevel VERBOSE) to record the fingerprint of every key used for login and correlate against approved keys.
Monitor file integrity of all ~/.ssh/authorized_keys files on Froxlor-managed hosts and alert on unexpected modifications.
Alert on Froxlor cron job runs that produce a non-zero delta in authorized_keys line counts relative to the number of managed keys.

How to Mitigate CVE-2026-90767

Immediate Actions Required

Upgrade all Froxlor installations to version 2.3.12 or later without delay.
Audit every authorized_keys file on Froxlor-managed systems and remove entries that do not match keys currently registered in the panel.
Rotate or revoke any SSH keys belonging to customers who could have exploited the endpoint prior to patching.

Patch Information

Froxlor version 2.3.12 addresses the vulnerability by validating that submitted SSH public keys are single-line values and rejecting inputs containing embedded newline characters. Refer to the Froxlor GitHub repository and GitHub Security Advisory GHSA-p3v3-74gc-jh5f for release details and fix commits.

Workarounds

Temporarily disable the customer-facing SSH key management functionality in Froxlor until the upgrade to 2.3.12 is complete.
Restrict SSH access on managed hosts to a hardened bastion or jump host and enforce key allowlisting outside of Froxlor's control plane.
Deploy a wrapper script around the Froxlor SSH cron job that rejects any customer key input containing newline or carriage return characters before writing to authorized_keys.

bash

# Configuration example: sanity check for authorized_keys files
for f in /home/*/.ssh/authorized_keys; do
  keys_in_file=$(grep -cvE '^\s*(#|$)' "$f")
  echo "$f: $keys_in_file entries"
  grep -nE '(command=|from=|environment=|no-pty)' "$f" && \
    echo "WARNING: option directives detected in $f"
done