Critical Security Flaws in OpenSSH: Multiple Vulnerabilities Identified
Summary
RLSA-2026:13380: Important: openssh security update. Affects openssh versions < 0:9.9p1-14.el10_1.rocky.0.1. Fixed in 0:9.9p1-14.el10_1.rocky.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenSSH is a widely used implementation of the SSH protocol, providing secure communication over unsecured networks. It is essential for remote server management and file transfers, supported by various operating systems including Linux and UNIX. The package includes both client and server components, making it a critical tool for system administrators. However, recent vulnerabilities have been identified that could potentially compromise the security of systems utilizing OpenSSH.
Vulnerability Detail
The vulnerabilities in OpenSSH include privilege escalation via the SCP legacy protocol when file mode is not preserved (CVE-2026-35385), a security bypass due to mishandling of the authorized_keys principals option (CVE-2026-35414), information disclosure from unintended cryptographic algorithm usage (CVE-2026-35387), low integrity impact from unconfirmed proxy-mode multiplexing sessions (CVE-2026-35388), and arbitrary command execution through shell metacharacters in usernames (CVE-2026-35386). These vulnerabilities can lead to unauthorized access, data leakage, and potential system compromise.
How To Fix
Minimum fixed version
0:9.9p1-14.el10_1.rocky.0.1
This is the first release that contains the fix.
sudo dnf update opensshTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling the SCP legacy protocol and reviewing the configuration of the authorized_keys file to ensure that principals are correctly defined. Additionally, avoid using shell metacharacters in usernames to mitigate the risk of arbitrary command execution.
Conclusion
The identified vulnerabilities in OpenSSH pose significant risks to system security, including privilege escalation and unauthorized access. It is crucial for users to update to the latest patched version and consider implementing workarounds until the update can be applied. Regular monitoring and updates are essential to maintain system integrity.
See every vulnerability recorded for openssh →
FAQ
OpenSSH is an open-source implementation of the SSH protocol, providing secure encrypted communications over a computer network.
The vulnerabilities can lead to privilege escalation, unauthorized access, information disclosure, and arbitrary command execution, posing significant security risks.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
It is recommended to regularly check for updates and apply them promptly to ensure your system is protected against known vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for openssh.
