Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
Loki package may skip address check when non-key callback used
published 23 days ago
Summary
The Loki software can fail to verify the source of a connection if a callback other than a public‑key is used, allowing unauthorized access. This bypass lets attackers avoid the usual address validation. Apply the latest Loki update that includes the fix or reconfigure it to use only public‑key callbacks.
What to do
- Update cleanstart loki to version 3.7.1-r1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | loki |
< 3.7.1-r1 Fix: upgrade to 3.7.1-r1
|
Original advisory text
Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation wou...
Security vulnerability affects the loki package. Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Timeline
Published26 Sep 2026
Updated26 Sep 2026
First seen26 Sep 2026
Sources
CLEANSTART-2026-OJ26404 · OSV
Track software like this
Free during beta