{"id":"CVE-2026-109786","revision":"0594768dc1e44d148337f51c5ee44b2e","records":[{"revision":"0594768dc1e44d148337f51c5ee44b2e","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-109786","aliases":[],"title":"In fail2ban 0.10.5 through 1.1.1 before ddd879d, the sshd filter (config/filter.d/sshd.conf) accepts an \"on <token>\" suffix after the host address. Because OpenSSH logs the offered username verbatim, a remote unauthenticated attacker can us…","description":"In fail2ban 0.10.5 through 1.1.1 before ddd879d, the sshd filter (config/filter.d/sshd.conf) accepts an \"on <token>\" suffix after the host address. Because OpenSSH logs the offered username verbatim, a remote unauthenticated attacker can use a username such as \"x VICTIM-SOURCE-IP-ADDRESS on\" to make fail2ban associate failed login attempts with an arbitrary source IP address and ban it (e.g., to block logins from a legitimate user). The default filter mode is affected.","state":0,"publishedAt":"2026-10-13T02:40:13.899+00:00","modifiedAt":"2026-10-15T15:04:19.106+00:00","affected":[{"ecosystem":"Vendor product","name":"fail2ban","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"defaultStatus\": \"unknown\",\n                    \"modules\": [\n                        \"sshd filter\"\n                    ],\n                    \"platforms\": [\n                        \"Linux\",\n                        \"Unix\"\n                    ],\n                    \"product\": \"fail2ban\",\n                    \"programFiles\": [\n                        \"config/filter.d/sshd.conf\"\n                    ],\n                    \"repo\": \"https://github.com/fail2ban/fail2ban\",\n                    \"vendor\": \"fail2ban\",\n                    \"versions\": [\n                        {\n                            \"lessThanOrEqual\": \"1.1.1\",\n                            \"status\": \"affected\",\n                            \"version\": \"0.10.5\",\n                            \"versionType\": \"custom\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","score":5.3,"severity":"MEDIUM"}],"references":["https://github.com/fail2ban/fail2ban/commit/ddd879d22664904ace24e1255ac6571808c58187","https://coredump.ws/repos/mail-hardening.git/"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-109786","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-109786","identifiers":["CVE-2026-109786"]},"retained":false,"historicalAffected":[]}],"coverage":[]}