Apache MINA SSHD CVE-2026-58624

Exploitation requires three concurrent conditions: (1) the attacker must hold a valid SSH account on the target server - CVSS PR:L confirms authentication is mandatory and no unauthenticated path exists; (2) the server must be explicitly configured to use GitPgmCommandFactory from org.apache.sshd:sshd-git - this is a non-default, opt-in deployment choice and is the single most significant limiting factor, as all standard MINA SSHD deployments are entirely unaffected; (3) the SSH-authenticated user must have network connectivity to the SSH port. The practical impact of arbitrary file writes is further bounded by the OS-level permissions of the SSHD process - writes are constrained to paths writable by the server process user. These conditions collectively restrict the vulnerable population to teams who have built custom git-hosting solutions on MINA SSHD using this specific factory.

The vendor CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) correctly reflects network accessibility and required SSH authentication (PR:L), but the Integrity:Low rating likely understates real-world impact for deployments where the SSH process has write access to sensitive paths such as ~/.ssh/authorized_keys, git hook directories, or web roots - scenarios common in self-hosted git infrastructure. The Availability:Low rating appears to reflect potential disk exhaustion from archive writes rather than a primary attack goal. No EPSS data was supplied and no KEV listing exists, indicating no confirmed active exploitation. The non-default configuration prerequisite (GitPgmCommandFactory must be explicitly enabled) substantially limits the exposed population - this is not a vulnerability in core MINA SSHD. Risk is real but scoped: highest for teams running custom git-hosting services on MINA SSHD with this factory enabled, negligible for all other MINA SSHD deployments.

An attacker with valid SSH credentials connects to a MINA SSHD server configured with GitPgmCommandFactory and issues a git archive --output=/home/git/.ssh/authorized_keys HEAD command, overwriting the server's authorized_keys file with attacker-controlled content and gaining persistent SSH access without credentials. No public exploit code has been identified, but the attack requires only standard SSH and git client tooling available on any developer workstation.