Skip to main content

Apache MINA SSHD CVE-2026-58624

| EUVDEUVD-2026-46101 MEDIUM
Improper Input Validation (CWE-20)
2026-07-20 apache GHSA-7229-w5mh-32hm
Apache Java Information Disclosure Red Hat Apache Mina Sshd Apache Software Foundation
5.4
CVSS 3.1 · Vendor: apache
Share

Severity by source

Vendor (apache) PRIMARY
5.4 LOW
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
vuln.today AI
6.5 MEDIUM

Arbitrary file write to any OS-accessible path warrants I:H; SSH authentication is mandatory (PR:L); no confidentiality or availability impact is described.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.4 MEDIUM
qualitative

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
Low

Lifecycle Timeline

4
Analysis Generated
Jul 20, 2026 - 21:34 vuln.today
Severity Changed
Jul 20, 2026 - 21:22 NVD
LOW MEDIUM
CVSS changed
Jul 20, 2026 - 21:22 NVD
5.4 (LOW) 5.4 (MEDIUM)
CVE Published
Jul 20, 2026 - 20:27 cve.org
MEDIUM 5.4

DescriptionCVE.org

Improper input validation in sshd-git in Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH.

Component org.apache.sshd:sshd-git provides though its GitPgmCommandFactory a way to configure an Apache MINA SSHD server such that SSH clients can remotely execute git commands via the JGit library on git repositories stored on the server.

This GitPgmCommandFactory allowed a user authenticated via SSH to run any JGit command available, including commands that could write files at arbitrary places such as git archive with the --output option.

Affected are SSH servers implemented with Apache MINA SSHD and using the GitPgmCommandFactory. If the GitPgmCommandFactory is not configured on the server, the server is not affected.

It is recommended to upgrade affected servers to Apache MINA SSHD 2.19.0 or 3.0.0-M5, which fix this issue.

The issue is fixed by restricting the available commands to a small whitelist of uncritical commands (such as git log). git archive is also allowed, but its --output argument is ignored and the archive is always sent through the SSH channel to the client.

AnalysisAI

Arbitrary file write in Apache MINA SSHD's sshd-git component enables any SSH-authenticated user to write files to arbitrary server filesystem paths via the JGit git archive --output argument. Servers are only affected when explicitly configured with GitPgmCommandFactory; the vulnerability does not exist in default MINA SSHD deployments. No public exploit code or CISA KEV listing exists at time of analysis; vendor-confirmed fixes are available in versions 2.19.0 and 3.0.0-M5.

Technical ContextAI

Apache MINA SSHD (CPE: cpe:2.3:a:apache_software_foundation:apache_mina_sshd) is a Java library providing SSH client and server functionality. The affected subcomponent org.apache.sshd:sshd-git exposes a GitPgmCommandFactory that proxies JGit commands to SSH clients, enabling git-over-SSH hosting. CWE-20 (Improper Input Validation) identifies the root cause: the factory applied no allowlist on which JGit commands or arguments were permitted, so the full JGit command surface was accessible. Critically, git archive accepts an --output flag that redirects archive content to a local filesystem path rather than through the SSH channel - a capability that is legitimate in local git usage but dangerous when exposed to remote SSH clients without sanitization. The fix explicitly allowlists safe commands and strips the --output argument from git archive invocations, routing archive output back through the SSH channel exclusively.

RemediationAI

Upgrade to Apache MINA SSHD 2.19.0 (stable) or 3.0.0-M5 (milestone), which are the vendor-confirmed fixed releases per the advisory at https://lists.apache.org/thread/7c3cry6pdy6hj1q0f28rc72x4o4tlyjo. These versions restrict JGit command execution to a whitelist of safe, read-oriented commands and suppress the --output argument in git archive invocations, returning archive data through the SSH channel instead. As an immediate compensating control prior to patching, remove GitPgmCommandFactory from the SSH server configuration entirely - this eliminates the attack surface with the trade-off of disabling all git-over-SSH functionality. If git access cannot be suspended, restrict SSH authorized_keys entries using the command= directive to limit which git operations individual keys may invoke, and ensure the SSHD process runs under a minimally privileged OS user account without write access to sensitive directories.

More in Java

View all
CVE-2012-4681 CRITICAL POC
9.8 Aug 28

Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
CVE-2015-7450 CRITICAL POC
9.8 Jan 02

Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
CVE-2013-2465 CRITICAL POC
9.8 Jun 18

Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
CVE-2011-3544 CRITICAL POC
9.8 Oct 19

Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
CVE-2010-1871 HIGH POC
8.8 Aug 05

JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
CVE-2012-1723 CRITICAL POC
9.8 Jun 16

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
CVE-2013-0422 CRITICAL POC
9.8 Jan 10

Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
CVE-2012-0507 CRITICAL POC
9.8 Jun 07

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
CVE-2015-4852 CRITICAL POC
9.8 Nov 18

The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers

CVE-2012-5076 CRITICAL POC
9.8 Oct 16

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
CVE-2017-3066 CRITICAL POC
9.8 Apr 27

Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
CVE-2012-0391 CRITICAL POC
9.8 Jan 08

The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during

Same weakness CWE-20 – Improper Input Validation

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2024-3400 CRITICAL POC
10.0
CVE-2022-47966 CRITICAL POC
9.8
CVE-2023-22515 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2017-9791 CRITICAL POC
9.8
CVE-2017-15944 CRITICAL POC
9.8
CVE-2019-0604 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Affected

Share

CVE-2026-58624 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy