CVE-2026-48113 is an incorrect authorization vulnerability (CWE-863) in jpillora chisel, a TCP/UDP tunnel over HTTP secured by SSH. In affected versions before 1.11.5, the access control list (ACL) enforced by the --authfile option is only checked during the initial handshake for declared remote endpoints. However, this ACL is not enforced on subsequent SSH channels that carry the actual tunneled traffic. As a result, an authenticated client can authenticate with a permitted remote and then open SSH channels to any arbitrary host and port accessible from the server, bypassing intended ACL restrictions. This flaw allows unauthorized traffic tunneling to arbitrary destinations. The vulnerability has been addressed and fixed in chisel version 1.11.5.

Authenticated clients can bypass intended access control restrictions and tunnel traffic to arbitrary destinations reachable from the server, potentially enabling unauthorized network access or data exfiltration through the chisel tunnel. This undermines the security model of the ACL enforcement and could lead to unauthorized network communications.

Upgrade chisel to version 1.11.5 or later, where this authorization bypass vulnerability has been fixed. No other mitigation is indicated by the vendor advisory.