chisel vulnerabilities

2 known vulnerabilities in chisel from Jpillora. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.5 High severity

  chisel: Incorrect Authorization

  CVE-2026-48113Aug 3, 2026Jpillora

  Chisel is a TCP/UDP tunnel, transported over HTTP and secured via SSH. In versions prior to 1.11.5, authenticated clients can bypass --authfile ACL restrictions and tunnel traffic to arbitrary destinations reachable from the server. The ACL is enforced only du

• 8.6 High severity

  chisel: Missing Authentication for Critical Functionality

  CVE-2024-43798Aug 26, 2024Jpillora

  Chisel is a fast TCP/UDP tunnel, transported over HTTP, secured via SSH. The Chisel server doesn't ever read the documented `AUTH` environment variable used to set credentials, which allows any unauthenticated user to connect, even if credentials were set. Any