CVE-2026-129120 json
C-Kermit 11.0.506 before 11.1.515 RECEIVE CONFIRM Bypass via Recursive GET
published 15d ago modified yesterday also EUVD-2026-125559 , GHSA-vhrv-7jrq-95qj
Unreviewed: the maintainers' own advisory
Published by the maintainers on their GitHub repository OpenKermit/ckermit. GitHub has not reviewed it into the GitHub Advisory Database, so the affected packages and versions are the maintainers' word. Read the full advisory on GitHub.
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 33%
- public exploits
- 0
- none known
Summary
C-Kermit 11.0.506 before 11.1.515 contains a RECEIVE CONFIRM bypass vulnerability that allows malicious Kermit servers to write unrequested files without prompting by abusing recursive GET root computation in ckcfns.c. Attackers can send files such as .ssh/authorized_keys or shell startup files under the current directory, which rq_under_root() accepts silently, enabling persistent access or code execution.
Patch / fix
- OpenKermit C-Kermit 11.1.515
- ckermit Debian 14 1:11.1.515-1
debian advisories DEBIAN-CVE-2026-129120
Is CVE-2026-129120 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerExploit prediction
0.39% chance of exploitation in the next 30 days, higher than 33% of all scored CVEs (FIRST EPSS, 2026-11-14).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 5.9 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N |
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N |
| CNA | 4.0 | 5.9 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N |
Affected products
- OpenKermit C-Kermit
Classification
- Weakness
-
- CWE-863 Incorrect Authorization
References
-
github.com
/OpenKermit/ckermit/commit/49e04a5ccfa08706b1d7e51dce4059f4adce50f3
patch
-
github.com
/OpenKermit/ckermit/security/advisories/GHSA-vhrv-7jrq-95qj
vendor-advisory, advisory
-
github.com
/OpenKermit/ckermit/releases/tag/v11.1.515
release-notes
-
github.com
/OpenKermit/ckermit/blob/v11.0.514/ckcfns.c#L3452
technical-description
-
vulncheck.com
/advisories/c-kermit-11.0.506-before-11.1.515-receive-confirm-bypass-via-recursive-get
third-party-advisory
Sources
- CVE List CVE-2026-129120
- NVD CVE-2026-129120
- Maintainer advisory GHSA-vhrv-7jrq-95qj
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
The maintainers of OpenKermit/ckermit published their own advisory on GitHub. Reviewed sources take precedence over it.