In older versions of Chisel, authenticated clients can bypass the --authfile ACL restrictions by opening arbitrary SSH channels after the initial handshake. The ACL is only enforced during the initial connection to a declared remote; once a client is authenticated, it may open post‑handshake channels to any host:port reachable from the server. This vulnerability allows the attacker to tunnel traffic to arbitrary destinations, effectively granting unrestricted network access through the Chisel tunnel and breaching the intended access controls.

The vulnerable product is Chisel, a TCP/UDP tunneling tool maintained by jpillora. All instances running versions prior to 1.11.5 are affected, while version 1.11.5 and newer contain the fix.

The CVSS score of 8.5 indicates high severity. The exploit probability is not documented in EPSS, and the vulnerability has not been listed in the CISA KEV catalog. The attack requires only a valid authenticated connection; a malicious client with legitimate credentials can open unauthorized channels. Because no additional authentication or privilege is required beyond what is already granted by the ACL, the flaw represents a direct privilege escalation from an authorized user to an unrestricted tunnel.