Vulnerability Description
Froxlor before 2.3.12 fails to properly validate multi-line SSH public keys in the SshKeys::add() endpoint, allowing customers to inject arbitrary lines into authorized_keys files. Attackers can inject malicious SSH key entries with option directives to gain persistent unauthorized access that survives key deletion and SSH access revocation.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/froxlor/Froxlor
- https://github.com/froxlor/Froxlor/blob/2.3.10/lib/Froxlor/Api/Commands/SshKeys.
- https://github.com/froxlor/Froxlor/blob/2.3.10/lib/Froxlor/Cron/System/SshKeys.p
- https://github.com/froxlor/Froxlor/security/advisories/GHSA-p3v3-74gc-jh5f
- https://www.vulncheck.com/advisories/froxlor-before-2.3.12-ssh-key-injection-via
- https://github.com/froxlor/Froxlor/security/advisories/GHSA-p3v3-74gc-jh5f
FAQ
What is CVE-2026-90767?
CVE-2026-90767 is a vulnerability with a CVSS score of 6.5 (MEDIUM). Froxlor before 2.3.12 fails to properly validate multi-line SSH public keys in the SshKeys::add() endpoint, allowing customers to inject arbitrary lines into authorized_keys files. Attackers can injec...
How severe is CVE-2026-90767?
CVE-2026-90767 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-90767?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.