Skip to content
OpenAdvisories

Package · Go

github.com/jpillora/chisel

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High 8.5
    CVE-2026-48113

    Chisel: ACL Bypass via Post-Handshake SSH Channel ExtraData Injection

    Chisel is a TCP/UDP tunnel, transported over HTTP and secured via SSH. In versions prior to 1.11.5, authenticated clients can bypass --authfile ACL restrictions and tunnel traffic to arbitrary destinations reachable from the server. The ACL is enforced only d…

    jpillora chisel github.com/jpillora/chisel Go
  • High 8.6
    CVE-2024-43798

    Chisel AUTH environment variable not respected in server entrypoint

    Chisel is a fast TCP/UDP tunnel, transported over HTTP, secured via SSH. The Chisel server doesn't ever read the documented `AUTH` environment variable used to set credentials, which allows any unauthenticated user to connect, even if credentials were set. An…

    jpillora chisel github.com/jpillora/chisel Go