CVE-2026-86231 Details
Description
A security flaw has been discovered in mwiede jsch up to 2.28.5. Affected is the function getRevokedKeys of the file src/main/java/com/jcraft/jsch/KnownHosts.java. Performing a manipulation of the argument known_hosts results in improper check for certificate revocation. The attack is possible to be carried out remotely. The attack is considered to have high complexity. The exploitability is told to be difficult. The exploit has been released to the public and may be used for attacks. Upgrading to version 2.28.6 is able to address this issue. The patch is named 194a2f76a5c0f1c3f778565be3fd66bcafc42d23. You should upgrade the affected component.
A vulnerability in mwiede jsch versions through 2.28.5 allows for a bypass of certificate revocation checks. The issue arises in the KnownHosts component, specifically within the getRevokedKeys function. When revocation entries for OpenSSH certificates are written using the certificate type string, they are silently discarded during parsing. This omission can lead to accepted connections for revoked certificates, undermining security protocols.
Users can upgrade to jsch version 2.28.6, which addresses this vulnerability by properly parsing revoked certificates and preserving the revocation markers.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 6, 2026CISA-ADP
Assessed Sep 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/mwiede/jsch/ | [email protected] | Vendor |
| https://github.com/mwiede/jsch/commit/194a2f76a5c0f1c3f778565be3fd66bcafc42d23 | [email protected] | Source CodeVendor |
| https://github.com/mwiede/jsch/issues/1091 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/mwiede/jsch/pull/1098 | [email protected] | Issue TrackingVendor |
| https://github.com/mwiede/jsch/releases/tag/jsch-2.28.6 | [email protected] | Release NotesVendor |
| https://vuldb.com/cve/CVE-2026-86231 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/898485 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/399388 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/399388/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-298 | Improper Validation of Certificate Expiration | [email protected] |
| CWE-299 | Improper Check for Certificate Revocation | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| mwiede jsch | <= 2.28.5 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 11, 2026 | CVE Modified | CISA-ADP |
| Sep 6, 2026 | New CVE Received | [email protected] |