Critical Security Update for OpenSSH: Privilege Escalation and Command Execution Vulnerabilities
Summary
RLSA-2026:19219: Important: openssh security update. Affects openssh versions < 0:9.9p1-7.el9_8.rocky.0.1. Fixed in 0:9.9p1-7.el9_8.rocky.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenSSH is a widely used implementation of the SSH (Secure Shell) protocol, providing secure communication over unsecured networks. It is essential for remote server management and secure file transfers. OpenSSH is supported by various operating systems, including Linux and UNIX. The recent vulnerabilities identified in OpenSSH can lead to serious security risks, including privilege escalation and arbitrary command execution, making it crucial for users to stay updated with the latest security patches.
Vulnerability Detail
The vulnerabilities in OpenSSH include privilege escalation via the legacy SCP protocol when file modes are not preserved (CVE-2026-35385), a security bypass due to mishandling of the authorized_keys principals option (CVE-2026-35414), information disclosure from unintended cryptographic algorithm usage (CVE-2026-35387), low integrity impact from unconfirmed proxy-mode multiplexing sessions (CVE-2026-35388), and arbitrary command execution through shell metacharacters in usernames (CVE-2026-35386). These vulnerabilities can lead to unauthorized access, data leaks, and potential system compromise.
How To Fix
Minimum fixed version
0:9.9p1-7.el9_8.rocky.0.1
This is the first release that contains the fix.
sudo dnf update opensshTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict the use of the SCP legacy protocol and review their authorized_keys configurations to ensure proper settings. However, applying the security update is the most effective solution.
Conclusion
The recent vulnerabilities in OpenSSH pose serious security risks that can lead to unauthorized access and data breaches. It is imperative for users to update their OpenSSH installations to the latest patched version to ensure their systems remain secure. Utilizing tools like Vulert can help monitor and manage open-source vulnerabilities effectively.
See every vulnerability recorded for openssh →
FAQ
OpenSSH is an open-source implementation of the SSH protocol, providing secure communication for remote administration and file transfers.
The vulnerabilities can lead to privilege escalation, unauthorized command execution, and potential data leaks, posing significant security risks.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading a manifest file like package-lock.json, you can check for vulnerabilities without needing to install any software.
While temporary workarounds exist, such as restricting SCP usage, the best approach is to apply the security updates as soon as possible.
The CVSS score for this vulnerability is 7.5, indicating a high severity level that requires immediate attention.
References
Related vulnerabilities
Recent vulnerabilities recorded for openssh.
