# CVE-2026-81535: wolfSSH forwarded-tcpip channel authorization bypass

Source: https://junglewise.ai/threats/cve-2026-81535-in-wolfssh-through-1-5-0-built-with-enable-fwd-dochannelopen-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-07. Updated: 2026-10-07  
License: CC BY 4.0 with a link back

CVE-2026-81535 · Severity: info · Published 2026-10-07

wolfSSH, an SSH library, improperly authorizes port-forwarding channel requests when built with forwarding enabled. A malicious SSH peer can open unauthorized forwarding channels that consume unbounded memory buffers, or cause a client to forward traffic for ports it never requested, potentially leading to denial of service or unintended network traffic routing.

Technologies: [Wolfssl wolfSSH](https://junglewise.ai/threats/technologies/wolfssl-wolfssh). Vendors: [Wolfssl](https://junglewise.ai/threats/vendors/wolfssl).

## Quick answers

**Is CVE-2026-81535 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-81535 being exploited in the wild.

**How severe is CVE-2026-81535?** Informational severity, published 7 October 2026.

**Which products and versions are affected?** Wolfssl wolfSSH through 1.5.0 when built with --enable-fwd.

**Is there a fix for CVE-2026-81535?** No fixed version is recorded yet. Disable SSH port forwarding by not building wolfSSH with the --enable-fwd option, or restrict SSH connections to trusted peers only until an upgrade is applied. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-81535 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-81535?** Check whether you run Wolfssl wolfSSH at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Disable SSH port forwarding by not building wolfSSH with the --enable-fwd option, or restrict SSH connections to trusted peers only until an upgrade is applied.

## Technical details

When --enable-fwd is used, the DoChannelOpen() function in src/internal.c gates direct-tcpip channel opens with a forwarding policy callback but fails to check forwarded-tcpip opens, allowing them through without authorization. This also violates RFC 4254 section 7.2, which requires clients to validate forwarded-tcpip opens against registered forwards. An attacker (malicious SSH peer or server) can exploit this to allocate unbounded per-channel buffers or open forwarding channels for unauthorized addresses and ports.

## Affected products

- wolfSSL wolfSSH through 1.5.0 when built with --enable-fwd

## Timeline

- 2026-10-07: disclosed

## References

- [https://github.com/wolfSSL/wolfssh/commit/616eb681e70759c30c3ba158f2b18d7bd954def8](https://github.com/wolfSSL/wolfssh/commit/616eb681e70759c30c3ba158f2b18d7bd954def8)
- [https://github.com/wolfSSL/wolfssh/commit/79a7f299337a28aa561409688a268d0efe6e295c](https://github.com/wolfSSL/wolfssh/commit/79a7f299337a28aa561409688a268d0efe6e295c)

## Related threats

- [wolfSSL wolfSSH Diffie-Hellman group exchange message handling bypass](https://junglewise.ai/threats/cve-2026-84897-src-internal-c-in-wolfssl-wolfssh-through-1-5-0-admits-the-server)
- [wolfSSL wolfSSH unsigned integer underflow in wstrncat()](https://junglewise.ai/threats/cve-2026-83742-unsigned-integer-underflow-in-wstrncat-in-src-port-c-in-wolfssl)
- [wolfSSL wolfSSHd Windows logon token release-of-resource vulnerability](https://junglewise.ai/threats/cve-2026-83540-when-password-or-public-key-authentication-is-used-with-the)
- [wolfSSH ECDSA curve substitution in host key parsing](https://junglewise.ai/threats/cve-2026-16516-wolfssh-does-not-validate-that-the-ecdsa-curve-identifier-in-a)