CVE-2026-81535: CWE-862 Missing Authorization in wolfSSL Inc. wolfSSH

In wolfSSH versions >=1.4.8 and <1.6.0 built with --enable-fwd, the DoChannelOpen() function in src/internal.c performs authorization checks only for direct-tcpip channel opens via the forwarding policy callback. However, forwarded-tcpip channel opens are accepted without any authorization checks and without limits on their number. This flaw allows a malicious SSH peer to cause the endpoint to allocate unbounded per-channel buffers for forwarding channels that the application never authorized. Furthermore, the client does not validate forwarded-tcpip opens against the forwards it registered with tcpip-forward requests, violating RFC 4254 section 7.2. This enables a malicious server to open forwarding channels for addresses and ports the client never requested to forward.

A remote attacker acting as a malicious SSH peer or server can exploit this vulnerability to cause unbounded memory allocation on the victim endpoint, potentially leading to resource exhaustion. The lack of authorization checks on forwarded-tcpip channels means unauthorized forwarding channels can be established, which may lead to denial of service or other impacts related to unauthorized network forwarding. There is no indication of code execution or data disclosure from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the --enable-fwd option if feasible or restrict SSH peers to trusted entities. Monitor vendor communications for patches addressing this authorization bypass. No vendor advisory or patch links are currently provided.