{"schema":"threatline.record/2","record":{"id":"CVE-2026-109786","aliases":[],"summary":"In fail2ban 0.10.5 through 1.1.1 before ddd879d, the sshd filter (config/filter.d/sshd.conf) accepts an \"on <token>\" suffix after the host address. Because OpenSSH logs the offered username verbatim, ","details":"In fail2ban 0.10.5 through 1.1.1 before ddd879d, the sshd filter (config/filter.d/sshd.conf) accepts an \"on <token>\" suffix after the host address. Because OpenSSH logs the offered username verbatim, a remote unauthenticated attacker can use a username such as \"x VICTIM-SOURCE-IP-ADDRESS on\" to make fail2ban associate failed login attempts with an arbitrary source IP address and ban it (e.g., to block logins from a legitimate user). The default filter mode is affected.","categories":["Unclassified"],"product":"fail2ban","vendor":"fail2ban","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109786","source_modified_at":"2026-10-15T15:04:19.106Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"fail2ban","vendor":"fail2ban","versions":[{"lessThanOrEqual":"1.1.1","status":"affected","version":"0.10.5","versionType":"custom"}],"defaultStatus":"unknown"}],"fixed_versions":[],"cvss":5.3,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00314,"percentile":0.23114,"score_date":"2026-10-23"},"published_at":"2026-10-13T02:40:13.899Z","modified_at":"2026-10-15T15:04:19.106Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-109786","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-15T15:04:19.106Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109786","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/fail2ban/fail2ban/commit/ddd879d22664904ace24e1255ac6571808c58187","tags":["patch"]},{"source":"CVE List","url":"https://coredump.ws/repos/mail-hardening.git/","tags":["related"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"partial","assessed_at":"2026-10-15T15:03:56.691809Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-15T15:04:19.106Z","content_hash":"a55f96e4170cb2d38a09ff7f67602ee4758e90bed728aa6575b997e786305fe8"}}