CVE-2026-90767: Froxlor

Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days.

Froxlor before 2.3.12 fails to properly validate multi-line SSH public keys in the SshKeys::add() endpoint, allowing customers to inject arbitrary lines into authorized_keys files. Attackers can inject malicious SSH key entries with option directives to gain persistent unauthorized access that survives key deletion and SSH access revocation.

Affected products

• Froxlor Froxlor: before 2.3.12 (fixed in 2.3.12)

Published 2026-09-13. Last modified 2026-09-23.