---
id: CVE-2026-48113
title: 'Chisel is a TCP/UDP tunnel, transported over HTTP and secured via SSH'
summary: >-
  Chisel is a TCP/UDP tunnel, transported over HTTP and secured via SSH. In
  versions prior to 1.11.5, authenticated clients can bypass --authfile ACL
  restrictions and tunnel traffic to arbitrary destinations reachable from the
  server. The …
severity: high
cwe:
  - CWE-863
vendor: jpillora
product: github.com/jpillora/chisel
affected:
  - github.com/jpillora/chisel <= 1.11.4
patched:
  - github.com/jpillora/chisel 1.11.5
published: '2026-08-03'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T20:36:14.340'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-48113'
references:
  - url: >-
      https://github.com/jpillora/chisel/commit/44310b65667a97901874ffdf4815b3732c22eaa3
    label: security-advisories@github.com
  - url: 'https://github.com/jpillora/chisel/security/advisories/GHSA-24fp-5v3p-rvpw'
    label: security-advisories@github.com
  - url: 'https://github.com/jpillora/chisel/security/advisories/GHSA-24fp-5v3p-rvpw'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://github.com/advisories/GHSA-24fp-5v3p-rvpw'
tags:
  - nvd
  - ghsa
  - go
epss: 0.00289
epssPercentile: 0.21736
aliases:
  - GHSA-24fp-5v3p-rvpw
ecosystem: go
ingestedAt: '2026-07-07T15:41:59.275Z'
---

## Overview

Chisel is a TCP/UDP tunnel, transported over HTTP and secured via SSH. In versions prior to 1.11.5, authenticated clients can bypass --authfile ACL restrictions and tunnel traffic to arbitrary destinations reachable from the server. The ACL is enforced only during the initial handshake against declared remotes, but never on subsequent SSH channels that carry actual traffic. A malicious client can authenticate with a permitted remote, then open channels to any host:port it wants. This issue has been fixed in version 1.11.5.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-48113)

Affected packages:

- `github.com/jpillora/chisel <= 1.11.4`

Patched in:

- `github.com/jpillora/chisel 1.11.5`

Source: https://github.com/advisories/GHSA-24fp-5v3p-rvpw