SB2026102844 - Multiple vulnerabilities in OpenSSH
Published: October 28, 2026 Updated: October 28, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 13 vulnerabilities.
1) Path traversal (CVE-ID: CVE-2026-106552)
CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to write files outside the intended destination directory.
The vulnerability exists due to path traversal in the sftp client when processing server-supplied paths during a recursive copy. A remote attacker can operate a malicious server that returns crafted paths to redirect file writes outside the target directory.
2) Sensitive Information in Resource Not Removed Before Reuse (CVE-ID: CVE-2026-106553)
CWE-ID: CWE-226 - Sensitive Information in Resource Not Removed Before Reuse
CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to obtain inappropriate access to credentials retained from a failed authentication attempt.
The vulnerability exists due to improper credential lifecycle management in sshd when a failed GSSAPI authentication attempt is followed by successful authentication using another method. A remote user can complete a subsequent authentication to potentially access GSSAPI credentials that should not have been retained.
3) Improper initialization (CVE-ID: CVE-2026-106555)
CWE-ID: CWE-665 - Improper Initialization
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause authentication state from an earlier attempt to affect a later attempt, potentially producing incorrect authentication decisions.
The vulnerability exists due to improper reinitialization of GSSAPI authentication state in sshd when processing successive authentication attempts. A remote attacker can initiate multiple authentication attempts to cause stale state to be confused with the state of a later attempt.
4) Observable discrepancy (CVE-ID: CVE-2026-106582)
CWE-ID: CWE-203 - Observable discrepancy
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to recover secret plaintext carried in another channel of an SSH connection.
The vulnerability exists due to observable ciphertext-length discrepancies in the shared LZ77 compression context used by ssh and sshd when multiplexed channels carry both secrets and attacker-controlled input. A remote attacker can introduce chosen plaintext into one channel and analyze the resulting ciphertext lengths to infer secrets transmitted through another channel.
5) Command injection (CVE-ID: N/A)
CWE-ID: CWE-77 - Command injection
CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary shell commands with the privileges of the user running the SSH client.
The vulnerability exists due to improper neutralization of shell metacharacters in ssh when an untrusted command-line username containing '$' or '' is used in a shell context such as ProxyCommand or Match exec. A remote attacker can supply a crafted username that the victim uses on the command line to inject shell commands.
6) Incorrect calculation (CVE-ID: CVE-2026-106584)
CWE-ID: CWE-682 - Incorrect Calculation
CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to potentially use an SSH certificate beyond its intended expiration time.
The vulnerability exists due to incorrect daylight saving time calculations in ssh-keygen when converting certificate validity dates. A local user can potentially use a certificate whose generated expiry time is later than intended to retain access during the unintended validity interval.
7) Improper Validation of Specified Quantity in Input (CVE-ID: CVE-2026-106585)
CWE-ID: CWE-1284 - Improper Validation of Specified Quantity in Input
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to potentially cause a denial of service through oversized decompressed SSH packets.
The vulnerability exists due to insufficient validation of decompressed packet length in ssh and sshd when processing compressed SSH payloads. A remote user can supply a compressed payload that expands beyond the maximum supported packet length to potentially exhaust resources or disrupt packet processing.
8) Incorrect authorization (CVE-ID: CVE-2026-106586)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to bypass authorized key restrictions on tunnel forwarding.
The vulnerability exists due to improper authorization in sshd when applying the authorized_keys restrict keyword to tunnel forwarding. A remote user can authenticate using a restricted key and request tunnel forwarding to establish a tunnel that the key restrictions should prohibit.
Exploitation requires tunnel forwarding to be enabled through PermitTunnel, which is disabled by default.
9) Interpretation Conflict (CVE-ID: CVE-2026-106587)
CWE-ID: CWE-436 - Interpretation Conflict
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to potentially bypass intended authentication policy by causing a file lookup that should have been disabled.
The vulnerability exists due to incorrect interpretation of configuration values in sshd when a Match block overrides an option such as AuthorizedPrincipalsFile with the value of "none". A remote attacker can attempt authentication under the affected configuration to potentially have sshd consult a literal file named none instead of disabling the configured file source.
10) Execution with unnecessary privileges (CVE-ID: N/A)
CWE-ID: CWE-250 - Execution with Unnecessary Privileges
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to bypass operating system access controls and perform certain forwarding operations with root privileges.
The vulnerability exists due to unnecessary retention of root privileges in sshd-session when the platform lacks file descriptor passing and requires root privileges for PTY allocation. A remote user can request forwarding operations to make Unix domain socket connections or bind low-numbered TCP ports with privileges unavailable to the logged-in user.
Affected platforms include QNX 6 and SCO OpenServer 5.
11) NULL pointer dereference (CVE-ID: N/A)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service by crashing the SFTP client.
The vulnerability exists due to a null pointer dereference in sftp when handling certain failed stat or lstat operations reported by a server. A remote attacker can operate a malicious server that returns an affected failure response to terminate the connected client.
12) Excessive Iteration (CVE-ID: N/A)
CWE-ID: CWE-834 - Excessive Iteration
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to potentially cause a denial of service through excessive CPU consumption while a private key is processed.
The vulnerability exists due to excessive iteration in OpenSSH private key processing in ssh-keygen, ssh, and sshd when an OpenSSH-format key specifies an extremely high number of key derivation rounds. A remote attacker can supply a crafted private key to a process that accepts it for loading to make key derivation consume excessive processing time.
13) Resource exhaustion (CVE-ID: N/A)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to potentially cause a denial of service through excessive CPU consumption before authentication.
The vulnerability exists due to CPU spinning caused by the NetBSD BROKEN_READ_COMPARISON workaround in OpenSSH when handling pre-authentication input. A remote attacker can potentially trigger the affected read-handling behavior over an SSH connection to consume server CPU resources.
Remediation
Install update from vendor's website.