Critical Vulnerability in OpenSSH: Multiple Security Flaws Identified
Summary
RLSA-2026:69130: Important: openssh security update. Affects openssh versions < 0:9.9p1-11.el9_8.rocky.0.1. Fixed in 0:9.9p1-11.el9_8.rocky.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenSSH is a widely used implementation of the SSH (Secure Shell) protocol, essential for secure remote login and file transfer across various operating systems, including Linux and UNIX. It provides both client and server functionalities, enabling secure communication over unsecured networks. The package is integral to system administration and secure data transmission, making its security paramount.
Vulnerability Detail
The identified vulnerabilities in OpenSSH include a flaw in the SFTP client that allows attackers to control the location of downloaded files (CVE-2026-59995), a security bypass due to improper handling of forwarding and tunneling options (CVE-2026-59999), and a tunnel forwarding restriction bypass (CVE-2026-73283). Additionally, the ssh-agent vulnerability permits remote execution of local operations (CVE-2026-73281), and a use-after-free issue in the ssh client can lead to information disclosure and data corruption (CVE-2026-73282). These vulnerabilities can lead to unauthorized access, data leaks, and potential system compromise.
How To Fix
Minimum fixed version
0:9.9p1-11.el9_8.rocky.0.1
This is the first release that contains the fix.
sudo dnf update opensshTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can restrict the use of the affected features by modifying the sshd_config file. For example, you can disable specific forwarding options by adding the following lines: 'AllowTcpForwarding no' and 'PermitTunnel no'. This will help mitigate the risk until the package is updated.
Conclusion
The vulnerabilities identified in OpenSSH pose significant risks to system security and data integrity. It is crucial to update the package to the latest version to mitigate these risks effectively. Implementing temporary workarounds can provide additional protection until the update is applied.
See every vulnerability recorded for openssh →
FAQ
OpenSSH is a suite of secure networking utilities based on the SSH protocol, providing encrypted communication over a computer network.
These vulnerabilities can lead to unauthorized access to systems, data leaks, and potential exploitation by attackers.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without signing up.
Implement the suggested workarounds to mitigate the risks until you can apply the security updates.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for openssh.
