Security Flaw in fail2ban SSHD Filter Affects Authentication Mechanism

CVE-2026-109786

What is CVE-2026-109786?

In specific versions of fail2ban, a vulnerability exists within the sshd filter that allows attackers to manipulate login attempts. By appending an 'on ' suffix to the host address, attackers can exploit the system to associate failed login attempts with an arbitrary source IP address. This manipulation can lead to legitimate users being inadvertently banned, compromising the integrity of authentication processes. The issue arises in the default filter mode and has been addressed in subsequent patches.

References