CVE-2026-129116 · Runtime
NO FIX YET · SEE WHAT TO DO
C-Kermit's IKSD server in its SSL build leaves Telnet authentication marked valid after a certificate login is refused. An attacker holding a trusted certificate mapped to a refused account can log in as any other account with any password and get that account's shell.
first public Oct 31, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Only servers running C-Kermit's IKSD in the SSL build, where certificate-based login is accepted. An attacker needs a trusted client certificate mapped to some account; systems without IKSD SSL or without certificate login are not exposed. Sources do not say how widely the SSL build is deployed.
Not affected if certificate-login-disabled, iksd-not-running, no-ssl-build
Who cares c-kermit, iksd, self-hosted, telnet
kermit -v or the package manager; affected range is 7.0.197 before 11.1.515.11.1.515 or later (per the product ranges).C-Kermit from 7.0.197 before 11.1.515 contains an authentication bypass vulnerability in the IKSD SSL build that leaves Telnet authentication state at AUTH_VALID after a refused certificate login. Attackers holding a trusted certificate mapped to a refused account can log in as any other account with any password, gaining that account's shell access.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.