RLSA-2026:88211: OpenSSH security update addresses authentication and forwarding flaws
Summary
RLSA-2026:88211: Security flaws in SSH authentication and forwarding can enable access-control bypasses, facilitate brute-force attacks, or cause denial of service. Affects openssh versions < 0:8.0p1-34.el8_10. Fixed in 0:8.0p1-34.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenSSH is an SSH protocol implementation in the Rocky Linux:8 ecosystem. It provides the core files needed for both SSH clients and servers. The software is supported across Linux, UNIX, and similar operating systems, where it enables secure remote access and related SSH services.
Vulnerability Detail
The reported flaws can bypass SFTP security checks and tunnel forwarding restrictions, facilitate brute-force attacks through insufficient authentication delays, or cause denial of service through excessive GSSAPI authentication attempts. The advisory also describes undocumented GSSAPIStrictAcceptorCheck behavior affecting security in Windows Active Directory. These issues span command-line argument parsing, authentication behavior, and forwarding controls; the supplied advisory does not provide further technical details about exploitation.
How To Fix
Minimum fixed version
0:8.0p1-34.el8_10
This is the first release that contains the fix.
sudo dnf update opensshTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
AI-generated workaround (not vendor-documented): Restrict access to OpenSSH services to trusted networks and limit who can use SFTP, GSSAPI authentication, and tunnel forwarding until the fixed version is installed. Review access controls for exposed SSH services.
Conclusion
Upgrade openssh to the minimum fixed version 0:8.0p1-34.el8_10 for Rocky Linux:8. This advisory covers multiple security issues affecting SSH authentication, SFTP, and tunnel forwarding. Review service exposure and access controls while arranging the update. Vulert monitors the dependencies in a manifest file like package-lock.json and alerts when a new vulnerability affects them; check an application at https://vulert.com/scanner.
See every vulnerability recorded for openssh →
FAQ
The openssh advisory affects versions introduced at 0 and fixed at 0:8.0p1-34.el8_10.
The openssh flaws can bypass SFTP or tunnel restrictions, facilitate brute-force attacks, and cause denial of service.
The minimum fixed openssh version is 0:8.0p1-34.el8_10 for the Rocky Linux:8 release line.
Restrict access to OpenSSH services and limit SFTP, GSSAPI authentication, and tunnel forwarding to trusted users and networks.
Check the application's manifest or SBOM for openssh. Vulert can scan a manifest or SBOM and monitor the dependency at Vulert Scanner.
References
Related vulnerabilities
Recent vulnerabilities recorded for openssh.
