EUVD-2026-46254
GHSA-fvwj-j79q-57v7
Severity by source
AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Local attack requiring low-privilege username control and user-initiated SSH connection; impact limited to environment variable disclosure and minor shell behavior alteration with no availability impact.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
1DescriptionCVE.org
A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables and causing unintended shell behavior.
AnalysisAI
Shell metacharacter injection in libssh's ProxyCommand handling allows a crafted SSH username to break out of the intended command string when the %r token is expanded. Affecting libssh deployments that use ProxyCommand with %r substitution, a low-privileged local attacker who controls the username passed to the connection can cause the shell executing the ProxyCommand to expand environment variables or alter its behavior, leaking sensitive environment data. No public exploit is identified and this is not listed in CISA KEV; CVSS rates this Low (3.9), consistent with the constrained local attack surface and limited impact.
Technical ContextAI
libssh is a C library implementing the SSH protocol used by numerous Linux applications and embedded systems. ProxyCommand is an SSH configuration directive that routes connections through an intermediary shell command; the %r token within ProxyCommand strings is replaced with the remote (target) username at connection time. When libssh performs this expansion without sanitizing shell metacharacters in the username, characters such as $, $(), backticks, semicolons, or pipes are passed verbatim into the shell command string, causing the /bin/sh interpreter executing the ProxyCommand to perform unintended variable expansion or command substitution. CWE is not formally assigned in the available data, but the root cause aligns with CWE-78 (OS Command Injection via improper neutralization of special elements) or CWE-116 (Improper Encoding or Escaping of Output). The issue was reported by Red Hat's security team (secalert@redhat.com), suggesting it affects Red Hat-distributed builds of libssh.
RemediationAI
Apply the vendor-released patch for libssh as distributed through the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-59846; the exact fixed version is not independently confirmed from the available data, and the Bugzilla entry at https://bugzilla.redhat.com/show_bug.cgi?id=2498179 should be monitored for fix version confirmation. As an immediate compensating control, audit all SSH client configurations that use ProxyCommand with %r expansion and replace %r with a hardcoded, trusted username where possible - this eliminates the injection vector but breaks dynamic username proxying workflows that legitimate multi-user jump-host setups may rely on. Alternatively, restrict which users can supply SSH usernames to ProxyCommand-using configurations, or wrap ProxyCommand execution in a script that sanitizes input before shell expansion. Avoid deploying libssh-based tooling in contexts where untrusted input directly influences the SSH username without sanitization.
More in Enterprise Linux
View allIn PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user.4.4
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
Local privilege escalation in the GNU C Library (glibc) dynamic loader ld.so allows unprivileged local users on affected
Linux distributions that have not patched their long-term kernels with https://git.kernel.org/linus/a87938b2e246b81b4fb7
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events
The Netlogon server implementation in smbd in Samba 3.5.x and 3.6.x before 3.6.25, 4.0.x before 4.0.25, 4.1.x before 4.1
Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.2
Sudo before 1.9.17p1 contains a local root escalation vulnerability (CVE-2025-32463, CVSS 9.3) through the --chroot opti
Same weakness CWE-77 – Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today