CVE-2026-90767
Froxlor before 2.3.12 fails to properly validate multi-line SSH public keys in the SshKeys::add() endpoint, allowing customers to inject arbitrary lines into authorized_keys files. Attackers can inject malicious SSH key entries with option directives to gain persistent unauthorized access that survives key deletion and SSH access revocation.
- Published Sep 13, 2026
- CVSS 7.1 high
- 0.4% chance of exploitation in the next 30 days (EPSS)
- A fix is available