CVE-2026-111239 · Infrastructure
NO FIX YET
An optional SSH administration service gives every user who logs in through its configured login domain full access to the administration shell, without checking for an admin role. An attacker with any such user's credentials, including a low-privileged application user, can run arbitrary code as the server process.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Systems running the optional SSH administration service whose configured login domain includes users who are not administrators. Exposure is higher if the service is reachable from untrusted networks. Servers where the service is disabled, or where only administrative users can log in, are not affected according to the sources' recommendations.
Not affected if admin-only-login-domain, network-restricted, service-disabled
Who cares self-hosted, ssh
Unknown from the sources.
The optional SSH administration service grants full access to the administration shell to every user that authenticates against its configured login domain, without checking for an administrative role. An attacker holding the credentials of any user in that domain, including a low-privileged application user, can execute arbitrary code as the server process. Users are recommended to disable the SSH administration service, or to block network access to it from untrusted clients and restrict its login domain to administrative users.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.