Critical Security Update for OpenSSH: Privilege Escalation and Command Execution Vulnerabilities
Summary
ALSA-2026:19069: Important: openssh security update. Affects openssh versions < 9.9p1-23.el10_2.alma.1. Fixed in 9.9p1-23.el10_2.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenSSH is a widely used implementation of the SSH (Secure Shell) protocol, which provides secure communication over an unsecured network. It is essential for managing remote servers and secure file transfers. OpenSSH includes both client and server components and is integral to many Linux and UNIX-based systems. The recent vulnerabilities discovered in OpenSSH could potentially allow attackers to escalate privileges, execute arbitrary commands, and bypass security measures, posing significant risks to system integrity and confidentiality.
Vulnerability Detail
The vulnerabilities in OpenSSH stem from several issues, including privilege escalation via the legacy SCP protocol when file modes are not preserved (CVE-2026-35385), a security bypass due to mishandling of the authorized_keys principals option (CVE-2026-35414), information disclosure from unintended cryptographic algorithm usage (CVE-2026-35387), low integrity impact from unconfirmed proxy-mode multiplexing sessions (CVE-2026-35388), and arbitrary command execution via shell metacharacters in usernames (CVE-2026-35386). These vulnerabilities can lead to unauthorized access, data leaks, and compromised system security.
How To Fix
Minimum fixed version
9.9p1-23.el10_2.alma.1
This is the first release that contains the fix.
sudo dnf update opensshTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict the use of the SCP legacy protocol and review the configuration of the authorized_keys file to ensure proper settings. Additionally, avoid using usernames with shell metacharacters until the update is applied.
Conclusion
The recent vulnerabilities in OpenSSH highlight critical security risks that could affect system integrity and confidentiality. It is essential to update to the latest patched versions of OpenSSH and its related packages to mitigate these risks. Implementing workarounds can provide temporary relief, but timely updates are crucial for maintaining security.
See every vulnerability recorded for openssh →
FAQ
OpenSSH is a suite of secure networking utilities based on the SSH protocol, allowing secure remote login and other secure network services.
The vulnerabilities can lead to privilege escalation, unauthorized command execution, and potential data breaches, compromising system security.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without requiring signup.
If immediate updates are not possible, implement workarounds such as restricting SCP usage and reviewing authorized_keys configurations.
It is advisable to regularly check for updates and security patches for all installed software, ideally on a weekly basis.
Related vulnerabilities
Recent vulnerabilities recorded for openssh.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.