CVE-2026-116779 FreeSWITCH defensive kit
=========================================
LAB-ONLY / DEFENSIVE USE. Offline. Reads your config tree and log exports.
Sends no SIP. Contains no exploit or payload code.

fs-116779-audit.py version "$(fs_cli -x version)"
fs-116779-audit.py config /etc/freeswitch
  Per-profile enable-chat / enable-chat-api-proto / auth-messages, plus
  directory users with no password and no a1-hash.
fs-116779-audit.py logs freeswitch.log [siptrace export]
  1.11.3+ rejection lines ("addressed to the 'api' chat proto") and inbound
  MESSAGE traces whose To user selects the api proto.
fs-116779-mitigate.sh /etc/freeswitch [--apply]
  Dry run by default. Adds enable-chat=false per profile (disables ALL inbound
  SIP chat on that profile). Lists password-less directory users.

Fixed version: FreeSWITCH 1.11.3 (released 2026-08-28). Leave
enable-chat-api-proto unset or false.
Sources: GHSA-mg63-h38w-8p9p, CVE-2026-116779 record, fix commit 7015f6a,
v1.11.3 release notes, CISA KEV 2026-11-09.
