CVE-2026-48851 - Vulnerability Details - OpenCVE

PuTTY 0.77 before 0.84 uses a copy of the PuTTY icon as a trust indication for TELNET data but the trust status is not cleared between proxy authentication and the main session.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Putty	Putty

Configuration 1 [-]

cpe:2.3:a:putty:putty:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://lists.tartarus.org/pipermail/putty-announce/2026/000042.html
https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/telnet-trust-sigil.html

History

Tue, 26 May 2026 13:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 25 May 2026 21:45:00 +0000

Type	Values Removed	Values Added
Title		Residual Trust Status Leak in PuTTY Telnet Sessions

Mon, 25 May 2026 20:45:00 +0000

Type	Values Removed	Values Added
Description		PuTTY 0.77 before 0.84 uses a copy of the PuTTY icon as a trust indication for TELNET data but the trust status is not cleared between proxy authentication and the main session.
First Time appeared		Putty Putty putty
Weaknesses		CWE-451
CPEs		cpe:2.3:a:putty:putty::::::::
Vendors & Products		Putty Putty putty
References		https://lists.tartarus.org/pipermail/putty-announce/2026/000042.html https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/telnet-trust-sigil.html
Metrics		cvssV3_1 `{'score': 3.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N'}`

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2026-05-25T20:16:31.485Z

Updated: 2026-05-26T12:40:49.268Z

Reserved: 2026-05-25T20:16:30.998Z

Link: CVE-2026-48851

Vulnrichment

Updated: 2026-05-26T12:40:45.994Z

NVD

Status : Analyzed

Published: 2026-05-25T21:16:35.400

Modified: 2026-05-27T19:12:40.117

Link: CVE-2026-48851

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-48851", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "state": "PUBLISHED", "assignerShortName": "mitre", "dateReserved": "2026-05-25T20:16:30.998Z", "datePublished": "2026-05-25T20:16:31.485Z", "dateUpdated": "2026-05-26T12:40:49.268Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "PuTTY", "vendor": "PuTTY", "versions": [{"lessThan": "0.84", "status": "affected", "version": "0.77", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "PuTTY 0.77 before 0.84 uses a copy of the PuTTY icon as a trust indication for TELNET data but the trust status is not cleared between proxy authentication and the main session."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.1, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-451", "description": "CWE-451 User Interface (UI) Misrepresentation of Critical Information", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-05-25T20:16:31.485Z"}, "references": [{"url": "https://lists.tartarus.org/pipermail/putty-announce/2026/000042.html"}, {"url": "https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/telnet-trust-sigil.html"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:putty:putty:*:*:*:*:*:*:*:*", "versionStartIncluding": "0.77", "versionEndExcluding": "0.84"}]}]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-26T12:40:42.460737Z", "id": "CVE-2026-48851", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-26T12:40:49.268Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-48851", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-26T12:40:42.460737Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-26T12:40:45.994Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.1, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "PuTTY", "product": "PuTTY", "versions": [{"status": "affected", "version": "0.77", "lessThan": "0.84", "versionType": "custom"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://lists.tartarus.org/pipermail/putty-announce/2026/000042.html"}, {"url": "https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/telnet-trust-sigil.html"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "descriptions": [{"lang": "en", "value": "PuTTY 0.77 before 0.84 uses a copy of the PuTTY icon as a trust indication for TELNET data but the trust status is not cleared between proxy authentication and the main session."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-451", "description": "CWE-451 User Interface (UI) Misrepresentation of Critical Information"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:putty:putty:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "0.84", "versionStartIncluding": "0.77"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-05-25T20:16:31.485Z"}}}, "cveMetadata": {"cveId": "CVE-2026-48851", "state": "PUBLISHED", "dateUpdated": "2026-05-26T12:40:49.268Z", "dateReserved": "2026-05-25T20:16:30.998Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-05-25T20:16:31.485Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}