Critical Security Update for OpenSSH: Privilege Escalation and Command Execution Vulnerabilities
Summary
ALSA-2026:13380: Important: openssh security update. Affects openssh versions < 9.9p1-14.el10_1.alma.1. Fixed in 9.9p1-14.el10_1.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenSSH is a widely used implementation of the SSH (Secure Shell) protocol, providing secure communication over unsecured networks. It includes essential components for both client and server operations, enabling secure file transfers and remote command execution. The recent vulnerabilities identified in OpenSSH could potentially allow unauthorized access and manipulation of systems, making it crucial for users to stay updated with the latest security patches.
Vulnerability Detail
The vulnerabilities in OpenSSH include privilege escalation via the legacy SCP protocol when file modes are not preserved (CVE-2026-35385), a security bypass due to mishandling of the authorized_keys principals option (CVE-2026-35414), information disclosure from unintended cryptographic algorithm usage (CVE-2026-35387), low integrity impact from unconfirmed proxy-mode multiplexing sessions (CVE-2026-35388), and arbitrary command execution through shell metacharacters in usernames (CVE-2026-35386). These vulnerabilities can lead to unauthorized access, data leaks, and potential system compromise.
How To Fix
Minimum fixed version
9.9p1-14.el10_1.alma.1
This is the first release that contains the fix.
sudo dnf update opensshTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict the use of the SCP legacy protocol and review the configuration of the authorized_keys file to ensure proper settings are in place. Additionally, avoid using usernames with shell metacharacters until the update is applied.
Conclusion
The recent vulnerabilities in OpenSSH highlight the importance of maintaining updated software to protect against potential security threats. By applying the recommended updates and following best practices, users can safeguard their systems from unauthorized access and exploitation.
See every vulnerability recorded for openssh →
FAQ
OpenSSH is an open-source implementation of the SSH protocol, providing secure encrypted communications over a computer network.
The vulnerabilities can lead to unauthorized access, privilege escalation, data leaks, and arbitrary command execution, posing significant security risks.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software by simply uploading your manifest file like package-lock.json.
While the best solution is to update, you can temporarily restrict the use of the SCP legacy protocol and review your authorized_keys configurations.
Detailed information can be found on the CVE pages listed in the advisory, which provide insights into the impact and technical details of each vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for openssh.
