Vulnerability record · CVE-2018-10933 · published 17 October 2018
CVE-2018-10933: libssh server authentication bypass via channel creation
Libssh · Libssh
libssh's server-side state machine before 0.7.6 and 0.8.4 allows a client to create channels without completing authentication, bypassing the login step entirely. Because libssh is embedded in many SSH servers and appliances, any exposed service using an affected version is reachable by an unauthenticated attacker.
Description
A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client could create channels without first performing authentication, resulting in unauthorized access.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Automated analysis
critical priorityUnauthenticated remote authentication bypass with a public exploit and very high EPSS probability makes this an urgent patch target.
What it is
libssh's server-side state machine before 0.7.6 and 0.8.4 allows a client to create channels without completing authentication, bypassing the login step entirely. Because libssh is embedded in many SSH servers and appliances, any exposed service using an affected version is reachable by an unauthenticated attacker.
Impact
An attacker gains unauthorized access to the SSH service with the privileges of the server process, without valid credentials. The CVSS vector shows high confidentiality and integrity impact with no availability impact.
Attack surface
Reached over the network by connecting to the SSH service and sending crafted protocol messages; no authentication is required and no user interaction is needed (AV:N/AC:L/PR:N/UI:N).
Exploitation
A public Exploit-DB entry (45638) exists and EPSS is 0.91789 (99.8th percentile), indicating high likelihood of exploitation; the CVE is not listed in CISA KEV.
What to do
- Upgrade libssh to 0.7.6 or 0.8.4 or later, or apply the vendor patch for your distribution.
- Patch or update dependent products listed by vendors (Ubuntu, Debian, Red Hat, NetApp, Oracle) that bundle libssh.
- Restrict network access to SSH services using affected libssh versions to trusted hosts only.
- Disable or remove unnecessary SSH services that rely on libssh until patched.
Detection
- Monitor SSH server logs for channel or session activity that occurs without a preceding successful authentication event.
- Alert on connections from unexpected source IPs that establish channels without completing the authentication exchange.
- Inventory hosts and applications for libssh versions below 0.7.6 or 0.8.4 and flag them for remediation.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
9 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2018-10933 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2018-10933), CISA KEV, FIRST EPSS (scores of 2026-09-24). This page is refreshed as NVD updates the record.
