CVE-2026-48113 is an incorrect authorization vulnerability (CWE-863) in jpillora chisel, a TCP/UDP tunnel over HTTP secured by SSH. In affected versions before 1.11.5, the access control list (ACL) specified by --authfile is enforced only during the initial handshake against declared remote endpoints. However, once authenticated, clients can open SSH channels to any host and port reachable from the server, bypassing ACL restrictions. This allows an authenticated client to tunnel traffic to arbitrary destinations, potentially violating intended access controls. The vulnerability has been addressed in chisel version 1.11.5.

Authenticated clients can bypass intended access control restrictions and tunnel traffic to arbitrary network destinations reachable from the server. This could lead to unauthorized network access or pivoting through the server to internal or restricted systems. The vulnerability requires authentication but does not require user interaction and has a high impact on confidentiality and integrity of network traffic.

Upgrade chisel to version 1.11.5 or later, where this authorization bypass vulnerability is fixed. No other official remediation or temporary fix is documented. Until upgrading, restrict client authentication and monitor for unauthorized tunneling activity as a precaution.