Four flaws in OpenSSH, GPUStack, FreeSWITCH and IBM Aspera Faspex added to CISA KEV as exploitation is confirmed
On 9 November 2026 CISA added four flaws to its Known Exploited Vulnerabilities catalog on the basis of active exploitation: CVE-2026-123158 in OpenSSH (cisa.gov), CVE-2026-102895 in GPUStack, CVE-2026-116779 in SignalWire FreeSWITCH and CVE-2026-123218 in IBM Aspera Faspex. The OpenSSH bug, nicknamed sshole, lets a remote party log in to a passwordless account when sshd runs on musl libc without PAM, and Alpine's default package fits that profile (horizon3.ai, ox.security). Help Net Security reported exploitation within hours of the 5 November disclosure (helpnetsecurity.com). The GPUStack flaw is the most exposed of the set, since its default configuration hands administrator rights to loopback-sourced requests without credentials (advisories.gitlab.com). The FreeSWITCH bug is a 9.8 command-execution flaw reachable through SIP MESSAGE, while the Aspera Faspex bug needs an authorized user, which narrows its reach (securityonline.info). Federal agencies were given a remediation deadline of 12 November 2026 (securityonline.info, cisa.gov).
Entenda a falha
A vulnerabilidade
Four CVEs were added to CISA KEV on 9 November 2026 after exploitation was confirmed. CVE-2026-102895 (CVSS 9.8, CWE-287) affects GPUStack before 2.2.0. With force_auth_localhost at its default of false, a request that appears to come from loopback is treated as the built-in administrator, with no credentials. CVE-2026-116779 (9.8, CWE-78) affects SignalWire FreeSWITCH before 1.11.3 and allows API and OS command execution with daemon privileges through a SIP MESSAGE; the feature is on by default. CVE-2026-123218 (CWE-863) affects IBM Aspera Faspex 5.0.0 through 5.0.19: an authorized user can bypass checks and gain full admin control (9.8 per one article, not confirmed against IBM or NVD). CVE-2026-123158 (8.1, CWE-394) affects OpenSSH before 10.6p2 on musl libc without PAM, such as Alpine, and allows login to passwordless accounts when password authentication is enabled.
Como funciona
In GPUStack, a request reaches get_current_user, which checks whether the source is loopback. The source can appear to be loopback through a same-host reverse proxy peer or a forged X-GPUStack-Real-IP header, so the request is promoted to administrator. In FreeSWITCH, an inbound SIP MESSAGE reaches sofia_presence_handle_sip_i_message, which splits the To user on a plus sign and hands the left part to the api chat protocol, so the caller's text runs as a FreeSWITCH API command. In OpenSSH on musl, a password longer than 256 bytes makes crypt() return an asterisk string. sshd compares that asterisk with the stored password field of an account that holds an asterisk, finds a match and lets the login through.
Por que é vulnerável
GPUStack trusted the apparent source address as proof of identity and auto-granted admin to loopback by default, while client-supplied headers and proxy peers could fake that source. FreeSWITCH exposed the api chat protocol to inbound SIP messages without restricting it, and did not treat the To user as untrusted input. In OpenSSH, musl's crypt() returns an error value for overlong passwords that is identical to the asterisk marking a locked or passwordless account, and sshd without PAM does not tell the two apart. The GPUStack 2.2.0 fix removes the loopback auto-admin path and hardens client IP handling. The FreeSWITCH fix adds an enable-chat-api-proto switch and a 403 response. The Aspera Faspex articles do not describe the exact missing check.
Onde está
GPUStack: get_current_user and the POST /v2/inference-backends/from-yaml endpoint; fix in pull request 5346, commit 53f42a6a553542974396d16a4ff6b12bcbedb48d. FreeSWITCH: function sofia_presence_handle_sip_i_message; fix in pull request 3135, commit 7015f6a73ab3d67fed5fbfc277ecfb88a74c2a86, GHSA-mg63-h38w-8p9p. The story did not open the pull request pages, so authors and merge dates are unconfirmed.
Como foi descoberta
The articles do not say who found these flaws. SignalWire's advisory GHSA-mg63-h38w-8p9p, published 28 October 2026, states that the FreeSWITCH path was already exploited in the wild. OpenSSH 10.6p2 was released on 5 November 2026 and Help Net Security reported exploitation within hours of that disclosure. CISA added all four CVEs to KEV on 9 November, with a federal remediation deadline of 12 November. One article's header says three were exploited, but its body and CISA list all four.
PoC pública
A public proof of concept was found only for GPUStack (CVE-2026-102895), listed on sploitus.com; the story gives no direct link. Exploitation in the wild is reported for all four flaws, so patch urgency is high even where no PoC is public. One article claims public OpenSSH exploit code on GitHub, but the story could not confirm it.
Explicação gerada por IA a partir da matéria e dos artigos, em 09/11/2026 22:18.
Detalhes técnicos
CVE-2026-123158 (CWE-394) carries a MITRE score of 8.1 and the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (safe.security). The bypass needs password logins enabled, an account whose stored password field holds an asterisk, and an overlong password above 256 bytes, which musl's crypt() turns into the same asterisk (cyberkendra.com, safe.security). Glibc systems, Debian, Ubuntu and RHEL, and sshd running with PAM fall outside the affected set (radar.cloudflare.com).
CVE-2026-102895 (CWE-287, CVSS 9.8) affects GPUStack before 2.2.0. With force_auth_localhost left at its default of false, get_current_user promotes any request whose source counts as loopback to the built-in administrator, and the source can be made loopback through a same-host reverse proxy peer or a forged X-GPUStack-Real-IP header (advisories.gitlab.com). From there an attacker can mint persistent admin API keys, read worker and cloud-provider secrets, and reach code execution on worker hosts through POST /v2/inference-backends/from-yaml (advisories.gitlab.com).
CVE-2026-116779 (CWE-78, CVSS 9.8) sits in the sofia_presence_handle_sip_i_message function, which splits the To user of an inbound SIP MESSAGE on a plus sign and passes the left side to the api chat protocol (vuldb.com, strix.ai). The result is FreeSWITCH API execution, including operating-system commands, with daemon privileges (radar.offseq.com). SignalWire's advisory GHSA-mg63-h38w-8p9p, published 28 October 2026, states that the path has been exploited in the wild and that the feature is on by default (rescana.com).
CVE-2026-123218 (CWE-863) is an incorrect-authorization flaw in IBM Aspera Faspex 5.0.0 through 5.0.19, which lets an authorized user send a crafted message that bypasses checks and grants full administrative control (securityonline.info). The article gives it a 9.8 score; this research did not open an IBM or NVD record to confirm that figure.
Detalhes da correção
OpenSSH 10.6p2, released on 5 November 2026, carries the fix (socprime.com, ionix.io). Alpine published patched openssh packages for edge and for branches from 3.16 through 3.24 (radar.cloudflare.com, cycognito.com).
GPUStack 2.2.0 removed the loopback auto-admin path and hardened client IP handling (nflo.tech). The release tag is github.com/gpustack/gpustack/releases/tag/v2.2.0, and the fix is linked to github.com/gpustack/gpustack/pull/5346 with commit 53f42a6a553542974396d16a4ff6b12bcbedb48d (sploitus.com). The pull request page could not be opened in this research pass, so its author and merge dates are not confirmed.
The FreeSWITCH fix is pull request github.com/signalwire/freeswitch/pull/3135, which adds an enable-chat-api-proto switch and a 403 response (blog.ostorlab.co, app.opencve.io). It ships in 1.11.3, tagged at github.com/signalwire/freeswitch/releases/tag/v1.11.3, with commit 7015f6a73ab3d67fed5fbfc277ecfb88a74c2a86 (app.opencve.io). The pull request page was not opened in this research pass, so its author and merge dates are not confirmed.
The article says the Aspera Faspex fix is the release after 5.0.19 (securityonline.info). No vendor page for this flaw was opened, so the exact fixed release is not confirmed here.
Remediação
Update OpenSSH to 10.6p2 or to the distribution's fixed package, then restart sshd. Until then, disable password authentication or enable PAM on musl systems (radar.cloudflare.com). If a login cannot be ruled out, treat the host as compromised (helpnetsecurity.com).
Update GPUStack to 2.2.0. Until then, set force_auth_localhost to true, strip client-supplied X-GPUStack-Real-IP headers at the edge, and keep the API off untrusted networks (radar.offseq.com, nflo.tech).
Update SignalWire FreeSWITCH to 1.11.3 (rescana.com) and IBM Aspera Faspex to a release beyond 5.0.19 (securityonline.info).
Relatos divergentes
The article's header reads "Status: 3 exploited", but its body and CISA's 9 November alert list all four flaws in the KEV catalog (cisa.gov). The CISA listing is the more authoritative source.
The article says Alpine Linux before 3.24.4 is affected. Cloudflare Radar and CyCognito place the affected Alpine range at 3.16 through 3.24 and edge (radar.cloudflare.com, cycognito.com).
The article says public exploit code for the OpenSSH bug is on GitHub. The only public proof of concept found in this research was for GPUStack (sploitus.com), so the OpenSSH claim is not confirmed.
The article does not state prerequisites for CVE-2026-116779. OffSeq describes an attacker with an authenticated profile (radar.offseq.com), while VulDB says any peer able to send accepted messages can run commands (vuldb.com). SignalWire's advisory notes the feature is on by default (rescana.com).
On 6 November, Help Net Security reported that CISA had not yet listed CVE-2026-123158 (helpnetsecurity.com). CISA added it on 9 November (cisa.gov), which is the later and authoritative record.
Linha do tempo
-
Four flaws in OpenSSH, GPUStack, FreeSWITCH and IBM Aspera Faspex added to CISA KEV as exploitation is confirmed
ler a análise desta fonte ocultar
On 9 November 2026 CISA added four flaws to its Known Exploited Vulnerabilities catalog on the basis of active exploitation: CVE-2026-123158 in OpenSSH (cisa.gov), CVE-2026-102895 in GPUStack, CVE-2026-116779 in SignalWire FreeSWITCH and CVE-2026-123218 in IBM Aspera Faspex. The OpenSSH bug, nicknamed sshole, lets a remote party log in to a passwordless account when sshd runs on musl libc without PAM, and Alpine's default package fits that profile (horizon3.ai, ox.security). Help Net Security reported exploitation within hours of the 5 November disclosure (helpnetsecurity.com). The GPUStack flaw is the most exposed of the set, since its default configuration hands administrator rights to loopback-sourced requests without credentials (advisories.gitlab.com). The FreeSWITCH bug is a 9.8 command-execution flaw reachable through SIP MESSAGE, while the Aspera Faspex bug needs an authorized user, which narrows its reach (securityonline.info). Federal agencies were given a remediation deadline of 12 November 2026 (securityonline.info, cisa.gov).
Technical Details
CVE-2026-123158 (CWE-394) carries a MITRE score of 8.1 and the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (safe.security). The bypass needs password logins enabled, an account whose stored password field holds an asterisk, and an overlong password above 256 bytes, which musl's crypt() turns into the same asterisk (cyberkendra.com, safe.security). Glibc systems, Debian, Ubuntu and RHEL, and sshd running with PAM fall outside the affected set (radar.cloudflare.com).
CVE-2026-102895 (CWE-287, CVSS 9.8) affects GPUStack before 2.2.0. With force_auth_localhost left at its default of false, get_current_user promotes any request whose source counts as loopback to the built-in administrator, and the source can be made loopback through a same-host reverse proxy peer or a forged X-GPUStack-Real-IP header (advisories.gitlab.com). From there an attacker can mint persistent admin API keys, read worker and cloud-provider secrets, and reach code execution on worker hosts through POST /v2/inference-backends/from-yaml (advisories.gitlab.com).
CVE-2026-116779 (CWE-78, CVSS 9.8) sits in the sofia_presence_handle_sip_i_message function, which splits the To user of an inbound SIP MESSAGE on a plus sign and passes the left side to the api chat protocol (vuldb.com, strix.ai). The result is FreeSWITCH API execution, including operating-system commands, with daemon privileges (radar.offseq.com). SignalWire's advisory GHSA-mg63-h38w-8p9p, published 28 October 2026, states that the path has been exploited in the wild and that the feature is on by default (rescana.com).
CVE-2026-123218 (CWE-863) is an incorrect-authorization flaw in IBM Aspera Faspex 5.0.0 through 5.0.19, which lets an authorized user send a crafted message that bypasses checks and grants full administrative control (securityonline.info). The article gives it a 9.8 score; this research did not open an IBM or NVD record to confirm that figure.
Fix Details
OpenSSH 10.6p2, released on 5 November 2026, carries the fix (socprime.com, ionix.io). Alpine published patched openssh packages for edge and for branches from 3.16 through 3.24 (radar.cloudflare.com, cycognito.com).
GPUStack 2.2.0 removed the loopback auto-admin path and hardened client IP handling (nflo.tech). The release tag is github.com/gpustack/gpustack/releases/tag/v2.2.0, and the fix is linked to github.com/gpustack/gpustack/pull/5346 with commit 53f42a6a553542974396d16a4ff6b12bcbedb48d (sploitus.com). The pull request page could not be opened in this research pass, so its author and merge dates are not confirmed.
The FreeSWITCH fix is pull request github.com/signalwire/freeswitch/pull/3135, which adds an enable-chat-api-proto switch and a 403 response (blog.ostorlab.co, app.opencve.io). It ships in 1.11.3, tagged at github.com/signalwire/freeswitch/releases/tag/v1.11.3, with commit 7015f6a73ab3d67fed5fbfc277ecfb88a74c2a86 (app.opencve.io). The pull request page was not opened in this research pass, so its author and merge dates are not confirmed.
The article says the Aspera Faspex fix is the release after 5.0.19 (securityonline.info). No vendor page for this flaw was opened, so the exact fixed release is not confirmed here.
Remediation
Update OpenSSH to 10.6p2 or to the distribution's fixed package, then restart sshd. Until then, disable password authentication or enable PAM on musl systems (radar.cloudflare.com). If a login cannot be ruled out, treat the host as compromised (helpnetsecurity.com).
Update GPUStack to 2.2.0. Until then, set force_auth_localhost to true, strip client-supplied X-GPUStack-Real-IP headers at the edge, and keep the API off untrusted networks (radar.offseq.com, nflo.tech).
Update SignalWire FreeSWITCH to 1.11.3 (rescana.com) and IBM Aspera Faspex to a release beyond 5.0.19 (securityonline.info).
Conflicting Reports
The article's header reads "Status: 3 exploited", but its body and CISA's 9 November alert list all four flaws in the KEV catalog (cisa.gov). The CISA listing is the more authoritative source.
The article says Alpine Linux before 3.24.4 is affected. Cloudflare Radar and CyCognito place the affected Alpine range at 3.16 through 3.24 and edge (radar.cloudflare.com, cycognito.com).
The article says public exploit code for the OpenSSH bug is on GitHub. The only public proof of concept found in this research was for GPUStack (sploitus.com), so the OpenSSH claim is not confirmed.
The article does not state prerequisites for CVE-2026-116779. OffSeq describes an attacker with an authenticated profile (radar.offseq.com), while VulDB says any peer able to send accepted messages can run commands (vuldb.com). SignalWire's advisory notes the feature is on by default (rescana.com).
On 6 November, Help Net Security reported that CISA had not yet listed CVE-2026-123158 (helpnetsecurity.com). CISA added it on 9 November (cisa.gov), which is the later and authoritative record.