Skip to content
TrackCVE
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage
Back

CVE-2026-109786

In fail2ban 0.10.5 through 1.1.1 before ddd879d, the sshd filter (config/filter.d/sshd.conf) accepts an "on <token>" suffix after the host…

Medium5.3EPSS 0.31%
Published
Updated
Reserved
Assigned by
mitre

Description

In fail2ban 0.10.5 through 1.1.1 before ddd879d, the sshd filter (config/filter.d/sshd.conf) accepts an "on <token>" suffix after the host address. Because OpenSSH logs the offered username verbatim, a remote unauthenticated attacker can use a username such as "x VICTIM-SOURCE-IP-ADDRESS on" to make fail2ban associate failed login attempts with an arbitrary source IP address and ban it (e.g., to block logins from a legitimate user). The default filter mode is affected.

Timeline

  1. ID reserved

    By mitre

  2. Published

  3. · 2 days later

    Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2026-109786, by who scored it
Scored byCVSSScoreVector
mitreCNA (assigner)3.1Medium5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
NVDNVD · Awaiting Analysis3.1Medium5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
EPSS (exploitation in 30 days)
0.31% · top 75% of all CVEs (7 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: yes · Technical impact: partial
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.3.

Weakness

Affected products

What to do

Solution: Apply upstream commit ddd879d22664904ace24e1255ac6571808c58187, or upgrade to the first fail2ban release after 1.1.1 that contains it.

Workaround: Override __on_port_opt and __suff in a local filter.d/sshd.local so that only an optional "port N" may follow the host address, as in the upstream fix: __on_port_opt = (?: port \d+)? and __suff = %(__on_port_opt)s(?: \[preauth\])?\s*. Add the administrator's own addresses to ignoreip.

References (2)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2026-109786 badge
[![CVE-2026-109786](https://trackcve.app/badge/CVE-2026-109786.svg)](https://trackcve.app/cve/CVE-2026-109786)

Record last updated .