CVE-2026-109786: Medium severity fail2ban fail2ban vulnerability
In fail2ban 0.10.5 through 1.1.1 before ddd879d, the sshd filter (config/filter.d/sshd.conf) accepts an "on <token>" suffix after the host address. Because OpenSSH logs the offered username verbatim, a remote unauthenticated attacker can use a username such as "x VICTIM-SOURCE-IP-ADDRESS on" to make fail2ban associate failed login attempts with an arbitrary source IP address and ban it (e.g., to block logins from a legitimate user). The default filter mode is affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
fail2banto a version that resolves this vulnerability.Patch ddd879d22664904ace24e1255ac6571808c58187
Event History
Frequently Asked Questions
Who can exploit this issue?
A remote, unauthenticated attacker who can submit SSH authentication attempts to a server monitored by Fail2Ban can exploit it. The attacker controls the offered SSH username, which OpenSSH records verbatim in its logs.
Are default Fail2Ban deployments affected?
Yes. The default sshd filter mode is affected in Fail2Ban versions 0.10.5 through 1.1.1 before commit ddd879d.
What is the practical impact?
An attacker can craft failed login attempts so Fail2Ban attributes them to an arbitrary victim source IP address and bans that address. This can block a legitimate user's SSH access without compromising confidentiality or integrity.
What should be done if an immediate upgrade is not possible?
The provided data identifies the corrected upstream commit as ddd879d22664904ace24e1255ac6571808c58187. Applying that fix to the sshd filter is the available remediation indicated by the data.