Critical Security Flaws in OpenSSH: Privilege Escalation and Command Execution Vulnerabilities
Summary
RLSA-2026:13381: Important: openssh security update. Affects openssh versions < 0:8.7p1-49.el9_7.rocky.0.1. Fixed in 0:8.7p1-49.el9_7.rocky.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenSSH is a widely used implementation of the SSH protocol, essential for secure remote access to servers and systems across various operating systems, including Linux and UNIX. It provides both client and server functionalities, enabling secure file transfers and remote command execution. However, recent vulnerabilities have been identified that could potentially compromise the security of systems utilizing OpenSSH.
Vulnerability Detail
The vulnerabilities in OpenSSH stem from several issues, including privilege escalation via the legacy SCP protocol, security bypass through mishandling of authorized_keys, information disclosure due to unintended cryptographic algorithm usage, low integrity impact from unconfirmed proxy-mode multiplexing sessions, and arbitrary command execution via shell metacharacters in usernames. These vulnerabilities can lead to unauthorized access, data exposure, and execution of arbitrary commands, posing significant risks to system integrity and confidentiality.
How To Fix
Minimum fixed version
0:8.7p1-49.el9_7.rocky.0.1
This is the first release that contains the fix.
sudo dnf update opensshTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict the use of the legacy SCP protocol and review the configuration of the authorized_keys file to ensure proper handling of principals options. Additionally, avoid using shell metacharacters in usernames to prevent arbitrary command execution.
Conclusion
The recent vulnerabilities in OpenSSH highlight critical security risks that can lead to unauthorized access and data breaches. It is essential for users to update their OpenSSH installations to the latest patched version and implement recommended workarounds to enhance security. Regular monitoring and updates are vital to maintaining a secure environment.
See every vulnerability recorded for openssh →
FAQ
OpenSSH is a suite of secure networking utilities based on the SSH protocol, providing encrypted communication over a computer network.
The main vulnerabilities include privilege escalation, security bypass, information disclosure, low integrity impact, and arbitrary command execution.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by these vulnerabilities without needing to sign up.
The CVSS score of the vulnerabilities is 7.5, indicating a high severity level.
It is recommended to regularly check for updates and apply them promptly to ensure your system is protected against known vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for openssh.
