OpenSSH CVE-2026-110925

Exploitation requires an OpenSSH client configuration in which a ProxyCommand or Match exec directive expands the %u token into a shell context; without %u used in those directives the flaw is not reachable. The attacker must be able to control or influence the username passed on the ssh command line (e.g., via a script, wrapper, or application that forwards untrusted input as the username), and a user/process must actually initiate the ssh connection (UI:R). Limiting factors: this is not exploitable against default OpenSSH configurations, execution occurs only with the privileges of the account running ssh (scope unchanged), and there is no server-side or standalone network trigger.

This is a command-injection flaw (CWE-78) in OpenSSH where shell metacharacters ('$' or a non-trailing backslash) in a command-line username survive into the shell when a configuration expands the %u token inside a ProxyCommand or Match exec directive. The Red Hat-assigned CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N, base 5.4) reflects the key tension in this issue: although the vector is network-reachable and unauthenticated (PR:N), it requires user interaction (UI:R) AND, critically, a non-default configuration that uses %u inside ProxyCommand/Match exec - a prerequisite the raw CVSS score does not capture and which the AC:L rating arguably understates. No EPSS score, CISA KEV listing, POC, or SSVC decision data was supplied, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The realistic verdict is a conditional, moderate-risk client-side injection rather than a mass-exploitable server flaw: impact only materializes where an application or script feeds attacker-influenced usernames into an OpenSSH client whose config expands %u in a shell context. For the overwhelming majority of deployments that do not use %u in ProxyCommand/Match exec, real-world risk is low despite OpenSSH's ubiquity.

An application or automation wrapper invokes the OpenSSH client with an externally supplied username, and the client's config expands %u inside a ProxyCommand or Match exec directive. An attacker submits a username containing '$' or a non-trailing backslash so that, when %u is expanded, the shell interprets those metacharacters and runs attacker-chosen commands as the user running ssh. No public exploit is identified at time of analysis; exploitation depends on the specific %u-in-shell configuration and on the attacker being able to influence the username.