Openssh CVE-2026-35414

The real-world risk is moderate but context-dependent. The CVSS score of 4.2 reflects low-to-moderate severity: the vulnerability requires authenticated access (PR:L), has high attack complexity (AC:H), and only achieves partial confidentiality and integrity impact (no availability impact). The EPSS probability and KEV status are not provided, but the absence of public exploit code and the restrictive attack preconditions suggest this is not an immediate critical threat. However, the vulnerability's placement in uncommon certificate configuration scenarios means it may affect organizations using advanced OpenSSH certificate-based authentication infrastructures. The attack requires an already-authenticated attacker with specific knowledge of the target's principals and CA configuration, significantly narrowing the threat surface compared to unauthenticated remote code execution vulnerabilities. Organizations running standard OpenSSH configurations without custom principals lists or those not using certificate-based authentication may face lower practical risk. This appears to be a low-probability but high-specificity vulnerability-difficult to exploit accidentally but potentially serious if certificate-based authentication is a core control.

An attacker with valid SSH credentials on a system running vulnerable OpenSSH (versions before 10.3) could craft or exploit a principals list containing specific comma-character patterns in conjunction with a malicious or specially configured certificate to trigger the parsing flaw. For example, if an organization uses certificate-based access control with principals like 'admin,user' or CA certificates with embedded commas in metadata, the attacker could manipulate authorization checks to either disclose which principals are authorized or bypass authorization restrictions on their current identity. However, the high attack complexity (AC:H) means the attack requires precise knowledge of the target system's certificate and principals configuration, making this difficult to exploit in generic or opportunistic attack scenarios.