authkeysync

AuthKeySync 自动从远程 URL 同步 SSH 公钥到您的服务器 📖 完整文档 问题 跨多台服务器管理 SSH 访问非常痛苦： 团队成员加入或离开时，你需要在每台服务器上更新 authorizedkeys 开发人员轮换 SSH 密钥，而现在你有 20 台服务器需要更新 你正在使用基础设施即代码，但 SSH 密钥管理仍是手动的 自制 bash 脚本进行密钥管理往往写得不好、不安全，或者存在细微的 bug，可能导致你无法登录服务器 你想使用 GitHub/GitLab 密钥，但到处复制太繁琐 解决方案 AuthKeySync 是一个轻量级 CLI，它从...

CVE-2018-11235

CVE-2018-11235 はじめに Docker コンテナをビルドするには、次を使用します： make docker 以下の make コマンドは、お使いのマシンの異なるターミナルで並行して実行してください 攻撃者サーバーのコンテナを起動するには、次を使用します： make runserver 被害者を表すコンテナを起動するには、次を使用します： make runclient コンテナは client.py スクリプトを起動します。このスクリプトは、自身の IP アドレスとユーザー名を攻撃者に送信します。 クライアントのコンソールの指示に従って、悪意のある git...

fortipwn

fortipwn Rustで構築されたForti CVE-2022-40684列挙スクリプト。 SSH公開鍵をauthorizedkeysにアップロードし、攻撃者がFortiOSを実行しているサーバーにadminとしてSSH接続できるようにします。 使用方法 $ ./fortipwn ビルド $ git clone https://github.com/Grapphy/fortipwn/ $ cd fortipwn $ cargo build --release $ cd target/release/ $ ./fortipwn 出力 $ ./fortipwn examplesip.tx...

CentOS Linux 7 [TuxCare] Security Update: openssh / openssh-askpass / openssh-cavs / openssh-clients / etc (CENTOS7:CLSA-2026:1777466402)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1777466402 advisory. - OpenSSH before 10.3 mishandles the authorizedkeys principals option in uncommon scenarios involving a principals list in conjunction with a...

CentOS Linux 8 [TuxCare] Security Update: openssh / openssh-askpass / openssh-cavs / openssh-clients / etc (CENTOS-STREAM8:CLSA-2026:1777393442)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1777393442 advisory. - OpenSSH before 10.3 mishandles the authorizedkeys principals option in uncommon scenarios involving a principals list in conjunction wi...

Rocky Linux 9.6 [TuxCare] Security Update: openssh / openssh-askpass / openssh-clients / openssh-keycat / etc (ALMALINUX9.6:CLSA-2026:1788887546)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1788887546 advisory. - In sshd in OpenSSH before 10.5, the restrict keyword in authorizedkeys was supposed to be applicable to tunnel forwarding but was not...

Rocky Linux 9.6 [TuxCare] Security Update: openssh / openssh-askpass / openssh-clients / openssh-keycat / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1776444688)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1776444688 advisory. - OpenSSH before 10.3 can use unintended ECDSA algorithms. Listing of any ECDSA algorithm in PubkeyAcceptedAlgorithms or...

CentOS Linux 8.4 [TuxCare] Security Update: openssh / openssh-askpass / openssh-cavs / openssh-clients / etc (CENTOS8.4:CLSA-2026:1777307655)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1777307655 advisory. - OpenSSH before 10.3 mishandles the authorizedkeys principals option in uncommon scenarios involving a principals list in conjunction with a...

AlmaLinux 9.6 [TuxCare] Security Update: openssh / openssh-askpass / openssh-clients / openssh-keycat / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1776444688)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1776444688 advisory. - OpenSSH before 10.3 can use unintended ECDSA algorithms. Listing of any ECDSA algorithm in PubkeyAcceptedAlgorithms or...

CVE-2026-82928

The mH-DEVELOPER smart home module contains a hardcoded SSH public key within /root/.ssh/authorized_keys, which functions as a potential backdoor . Because the SSH daemon starts automatically and permits root login via key authentication, an attacker possessing the matching private key can obtain...

cve-2026-11837-ansible-posix-authorized-key

CVE-2026-11837: ansible.posix authorizedkey 本地权限提升 通过跟随符号链接的 chown（以及跟随符号链接的文件创建）对用户的 /.ssh 目录和 authorizedkeys 文件，在 ansible.posix.authorizedkey Ansible 模块中实现本地权限提升。 这是一份关于我报告的漏洞的书面说明，该漏洞已被红帽产品安全团队（CNA）分配为 CVE-2026-11837 。此处作为技术记录发布，而非声称具有新颖性：该问题是 CVE-2024-9902 的 同源问题 ，早期修复未覆盖到该模块。 官方参考 红帽 CVE...

EUVD-2026-83054

btrbk is a tool for creating snapshots and remote backups of Btrfs subvolumes. From 0.29.0 until 0.32.7, btrbk's sshfilterbtrbk.sh constructs allowstreammatch with a start anchor but without an end-of-string anchor for the complete command. A user restricted through an authorizedkeys forced comma...

CVE-2026-62943: Improper Neutralization of Special Elements used in an OS Command

btrbk is a tool for creating snapshots and remote backups of Btrfs subvolumes. From 0.29.0 until 0.32.7, btrbk's sshfilterbtrbk.sh constructs allowstreammatch with a start anchor but without an end-of-string anchor for the complete command. A user restricted through an authorizedkeys forced comma...

K000163318: OpenSSH vulnerability CVE-2026-35414

Security Advisory Description OpenSSH before 10.3 mishandles the authorizedkeys principals option in uncommon scenarios involving a principals list in conjunction with a Certificate Authority that makes certain use of comma characters. CVE-2026-35414 Impact There is no impact; F5 products are not...

Astra Linux – Vulnerability in rsync

A vulnerability was discovered in rsync prior to version 3.2.5. This vulnerability allows malicious remote servers to write arbitrary files into the directories of connecting peers. The server determines which files/directories are sent to the client. However, the rsync client lacks sufficient...

Astra Linux – Vulnerability in python-pip

The pip package before version 19.2 for Python allows Directory Traversal when a URL is provided in an install command. This is possible because the Content-Disposition header can contain "../ in the filename, as demonstrated by overwriting the /root/.ssh/authorizedkeys file. This behavior occurs...

Astra Linux – Vulnerability in OpenSSH

OpenSSH versions prior to 10.3 mishandle the authorizedkeys principals option in unusual scenarios where a principals list is used in conjunction with a Certificate Authority that utilizes comma characters...

CVE-2026-90767

Froxlor before 2.3.12 fails to properly validate multi-line SSH public keys in the SshKeys::add endpoint, allowing customers to inject arbitrary lines into authorizedkeys files. Attackers can inject malicious SSH key entries with option directives to gain persistent unauthorized access that...

CVE-2026-90767 Froxlor before 2.3.12 SSH Key Injection via authorized_keys

Froxlor before 2.3.12 fails to properly validate multi-line SSH public keys in the SshKeys::add endpoint, allowing customers to inject arbitrary lines into authorizedkeys files. Attackers can inject malicious SSH key entries with option directives to gain persistent unauthorized access that...

CVE-2026-90767 Froxlor before 2.3.12 SSH Key Injection via authorized_keys

Froxlor before 2.3.12 fails to properly validate multi-line SSH public keys in the SshKeys::add endpoint, allowing customers to inject arbitrary lines into authorizedkeys files. Attackers can inject malicious SSH key entries with option directives to gain persistent unauthorized access that...