Skip to main content

Apache Mina Sshd CVE-2026-56624

| EUVDEUVD-2026-46103 HIGH
Improper Certificate Validation (CWE-295)
2026-07-20 apache GHSA-j262-jh5j-p4fw
Apache Java Information Disclosure SSH Apache Mina Sshd Apache Software Foundation
7.3
CVSS 3.1 · Vendor: apache
View

Vulnerability Assessment

Weakness
CWE
CWE-295
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V12 - Secure Communication Certificate validation
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 20, 2026

Command-restriction bypass in Apache MINA SSHD (server-side) lets a user who authenticates with an OpenSSH user certificate carrying a force-command directive execute arbitrary commands instead of the single restricted command the certificate authority intended. The server accepts and honors such certificates but silently ignores the force-command and verify-required options, breaking the security model that certificate issuers rely on to constrain principals. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the flaw is confirmed and fixed by the Apache Software Foundation in versions 2.19.0 and 3.0.0-M5.

Affected VersionsENISA

Apache Mina SSHD 2.0.0 ≤2.18.0
Apache Mina SSHD 3.0.0-M1 ≤3.0.0-M4

Affected Packages

euvd apache_mina_sshd no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Know when Apache Mina Sshd gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (apache) PRIMARY 7.3 MEDIUM
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
SUSE HIGH
Red Hat 7.3 HIGH

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Lifecycle Timeline

3
Severity Changed
Jul 20, 2026 - 21:22 NVD
MEDIUM HIGH
CVSS changed
Jul 20, 2026 - 21:22 NVD
7.3 (MEDIUM) 7.3 (HIGH)
CVE Published
Jul 20, 2026 - 20:28 cve.org
HIGH 7.3

DescriptionCVE.org

Improper certificate validation in Apache MINA SSHD (server-side). Apache MINA SSHD is a Java library for client-side and server-side SSH.

Server-side OpenSSH user certificate validation during user authentication in an Apache MINA SSHD server did not check for the unsupported force-command or verify-required options that could be embedded in the certificate, nor did it validate these options. As a result it was possible that a user could authenticate with such a certificate that included a force-command option but still was able to execute other commands. What other command exactly would be available to the user depends on the implementation of the server.

This issue is fixed in Apache MINA SSHD 2.19.0 and 3.0.0-M5. Applications are advised to upgrade to these versions.

The fix rejects OpenSSH user certificates that include these options, since Apache MINA SSHD implements neither force-command nor sk-*-cert-v01@openssh.com user certificates (which are the only ones for which verify-required would make sense).

Articles & Coverage 4

News 4 New Java Vulnerabilities - 4 High Severity Patched Jul 21, 2026 News 6 New Apache Vulnerabilities - 6 High Severity, No POC Available Jul 21, 2026 News 4 New Java Vulnerabilities - 4 High Severity Jul 20, 2026 News 6 New Apache Vulnerabilities - 6 High Severity Jul 20, 2026

Executive ViewAI

Why It Matters

Authentication-required vulnerability in Apache MINA SSHD undermines SSH certificate-based access control, allowing authenticated users to bypass intended command restrictions and execute arbitrary commands. This impacts organizations that rely on force-command restrictions in SSH certificates to segment user permissions and limit lateral movement.

Recommended Action

Within 24 hours, identify all systems running Apache MINA SSHD and inventory those using OpenSSH certificate-based authentication with force-command restrictions. Within 7 days, upgrade all affected systems to Apache MINA SSHD version 2.19.0 or 3.0.0-M5 and validate the upgrades in a test environment before production deployment. Within 30 days, conduct SSH access log analysis for unauthorized command execution and audit certificate issuance policies to confirm force-command usage is properly configured.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.2%
Top 94% exploitable
Social Media
2
Sightings
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor CIRCL

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact
High
Technical Impact
Total

Priority Score

36
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +36
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Apache Mina Sshd

View all
CVE-2026-56452 HIGH
7.5 Jul 20

Arbitrary file write in Apache MINA SSHD's sshd-scp component lets a malicious SCP sender place files outside the intend
CVE-2026-56623 HIGH
7.1 Jul 20

Path traversal in Apache MINA SSHD's sshd-git component lets an authenticated remote user on Windows-hosted git servers

CVE-2026-93995 MEDIUM
6.5 Sep 29

Improper input validation in the sshd-git component of Apache MINA SSHD lets authenticated SSH clients write arbitrary f
CVE-2026-58624 MEDIUM
5.4 Jul 20

Arbitrary file write in Apache MINA SSHD's sshd-git component enables any SSH-authenticated user to write files to arbit

Same weakness CWE-295 – Improper Certificate Validation

View all
CVE-2026-85102 CRITICAL POC
9.8
CVE-2015-3152 MEDIUM POC
5.9
CVE-2017-2800 CRITICAL POC
9.8
CVE-2014-1266 HIGH POC
7.4
CVE-2022-47758 CRITICAL POC
9.8
CVE-2025-68121 CRITICAL POC
10.0
CVE-2025-29331 CRITICAL POC
9.8
CVE-2025-32878 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Important
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Affected

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:51653 ADVISORY https://access.redhat.com/errata/RHSA-2026:53643 ADVISORY https://access.redhat.com/errata/RHSA-2026:54776 ADVISORY https://lists.apache.org/thread/o4c2jml522j3z80gbryqzc2f1253ltp6 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-56624 ADVISORY https://seclists.org/oss-sec/2026/q3/189 REF http://www.openwall.com/lists/oss-security/2026/07/20/17

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy