From f7e7fd7de16ce1d1539f0c9b4be27de0228d0160 Mon Sep 17 00:00:00 2001
From: Vishal Dalwadi <dalwadivishal26@gmail.com>
Date: Mon, 28 Sep 2026 21:48:32 +0530
Subject: [PATCH] feat(go): prevent self ssh;

---
 logic/acls.go | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/logic/acls.go b/logic/acls.go
index d1f9a695d..d09bb2ff2 100644
--- a/logic/acls.go
+++ b/logic/acls.go
@@ -277,6 +277,18 @@ func GetSshAuthorizedIdentitiesForNode(ctx context.Context, targetnode *models.N
 						continue
 					}
 					seen[dedupeKey] = struct{}{}
+					// Never grant a node SSH access to itself, however the
+					// match happened (wildcard, a shared tag, an explicit
+					// same-node Src). A node connecting to its own address
+					// doesn't prove it's really a remote WireGuard peer -
+					// unlike every other peer, any local, unprivileged
+					// process on the target can reach the target's own
+					// address directly, without ever going through
+					// WireGuard, bypassing the source-IP trust Managed SSH
+					// otherwise relies on entirely.
+					if !n.IsStatic && n.ID.String() == targetnode.ID.String() {
+						continue
+					}
 					if n.IsStatic {
 						if !n.StaticNode.Enabled {
 							continue