Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

cleanstart/loki may ignore SSH certificate restrictions

published 23 days ago
Summary

The Loki software that handles SSH logins can lose the extra rules attached to a user’s certificate when a certain authentication step succeeds. This means the intended limits, like forcing a specific command, might not be enforced. Update Loki to the latest version or apply the vendor’s fix to ensure those restrictions are kept.

What to do
  • Update cleanstart loki to version 3.7.1-r1.
Affected software
Ecosystem VendorProductAffected versions
CleanStart cleanstart loki < 3.7.1-r1
Fix: upgrade to 3.7.1-r1
Original advisory text
When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as fo...
Security vulnerability affects the loki package. When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.8 Critical
Timeline
Published26 Sep 2026
Updated26 Sep 2026
First seen26 Sep 2026
Sources
CLEANSTART-2026-CG56781 · OSV
Track software like this
Free during beta