CVE-2026-48113 jpillora CVE debrief

Who should care

Defenders of Chisel servers and networks should assess exposure and prioritize upgrading to version 1.11.5. Operators of Chisel servers, security teams, and vulnerability management teams should review the CVE record and NVD entry to validate affected scope, severity, and vendor guidance. They should also verify exposure, review compensating controls, and monitor for suspicious traffic patterns.

Why it matters

Authenticated clients can bypass ACL restrictions in Chisel versions prior to 1.11.5, potentially leading to unauthorized traffic tunneling.

• Verify Chisel server exposure to unauthorized traffic
• Assess and update ACL configurations to prevent bypass
• Monitor for suspicious traffic patterns

Technical summary

Authenticated clients can bypass --authfile ACL restrictions and tunnel traffic to arbitrary destinations reachable from the server in Chisel versions prior to 1.11.5. This issue has been fixed in version 1.11.5. The vulnerability allows malicious clients to authenticate with a permitted remote and then open channels to any host:port they want, potentially leading to unauthorized traffic tunneling. Defenders should prioritize verifying exposure of Chisel servers and upgrading to version 1.11.5. The CVE record and NVD entry provide details on the vulnerability and its fix.

Defensive priority

Defenders should prioritize verifying exposure of Chisel servers and upgrading to version 1.11.5.

Recommended defensive actions

• Verify Chisel server exposure and upgrade to version 1.11.5
• Review and update ACL configurations
• Monitor for suspicious traffic
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability and its fix in Chisel version 1.11.5. Evidence from the CVE Program and NIST NVD detail page confirms the vulnerability and its impact. The issue has been fixed in version 1.11.5, and defenders should verify exposure and upgrade to this version. The CVE record was published on 2026-08-03T21:16:39.597Z and has not been modified since then.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.