SB2026093042 - Ubuntu update for openssh
Published: September 30, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 10 vulnerabilities.
1) Input validation error (CVE-ID: CVE-2026-35386)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to execute arbitrary shell commands.
The vulnerability exists due to improper input validation in ssh(1) when expanding %-tokens from ssh_config using a user name supplied on the command-line. A local user can supply a specially crafted user name to execute arbitrary shell commands.
Exploitation requires a configuration that uses the %u token in a Match exec block.
2) Improper access control (CVE-ID: CVE-2026-35387)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to bypass configured public key algorithm restrictions.
The vulnerability exists due to improper access control in sshd(8) when applying PubkeyAcceptedAlgorithms and HostbasedAcceptedAlgorithms to ECDSA keys. A remote user can authenticate using an unlisted ECDSA algorithm to bypass configured public key algorithm restrictions.
The issue occurs when one of these directives includes any ECDSA algorithm name.
3) Improper access control (CVE-ID: CVE-2026-35414)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to bypass principal restrictions in certificate-based authentication.
The vulnerability exists due to improper access control in sshd(8) when matching an authorized_keys principals="" option against a list of principals in a certificate. A remote user can present a specially crafted certificate to bypass principal restrictions in certificate-based authentication.
This condition only affects user-trusted CA keys in authorized_keys and requires multiple principals to be listed, including a certificate principal containing a comma character.
4) Path traversal (CVE-ID: CVE-2026-59995)
CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to write files to an unexpected location.
The vulnerability exists due to improper path restriction in sftp(1) when downloading files on the command line using a remote path and a local dot destination. A remote attacker can operate a malicious server to write files to an unexpected location.
5) Improper Neutralization of Argument Delimiters in a Command (CVE-ID: CVE-2026-59997)
CWE-ID: CWE-88 - Argument Injection or Modification
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to bypass security-relevant SFTP server options.
The vulnerability exists due to improper input handling in the internal-sftp SFTP server implementation when processing long command lines. A remote privileged user can supply a command line with security-relevant options placed after the ninth argument to bypass security-relevant SFTP server options.
Only configurations using the internal-sftp SFTP server implementation are affected.
6) Configuration (CVE-ID: CVE-2026-59998)
CWE-ID: CWE-16 - Configuration
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The issue may allow a remote user to bypass implemented security restrictions.
The issue exists due to the the application has an undocumented security-relevant behavior: GSSAPIStrictAcceptorCheck has no value if the server is in Windows Active Directory. A remote user can bypass implemented security restriction.
7) Improper access control (CVE-ID: CVE-2026-59999)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to enable tunneling despite forwarding restrictions.
The vulnerability exists due to improper access control in sshd(8) when DisableForwarding=yes and PermitTunnel=yes are configured together. A remote privileged user can use tunneling despite forwarding restrictions to enable tunneling despite forwarding restrictions.
Exploitation requires configurations where PermitTunnel is enabled.
8) Resource exhaustion (CVE-ID: CVE-2026-60000)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper resource handling in sshd(8) when processing pre-authentication GSSAPI requests. A remote attacker can send crafted authentication attempts to cause a denial of service.
Only configurations with GSSAPIAuthentication enabled are affected.
9) Protection mechanism failure (CVE-ID: CVE-2026-60001)
CWE-ID: CWE-693 - Protection Mechanism Failure
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to weaken authentication rate limiting.
The vulnerability exists due to improper enforcement of security policy in sshd(8) when handling authentication attempts. A remote attacker can send authentication attempts to weaken authentication rate limiting.
The issue affects cases where the minimum authentication delay was not enforced.
10) Use-after-free (CVE-ID: CVE-2026-73282)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to use-after-free in the ssh client remote forwarding handling when a remote forwarding is added via the local session multiplexing socket while a remote forwarding open request is pending with the server. A remote user can trigger this race condition to cause a denial of service.
Exploitation requires access to the local session multiplexing socket while a remote forwarding open request is pending.
Remediation
Install update from vendor's website.