Skip to main content

OpenSSH CVE-2026-59999

| EUVDEUVD-2026-42142 HIGH
Use of Less Trusted Source (CWE-348)
2026-07-08 mitre GHSA-gcm2-x6hm-q4h3
Information Disclosure SSH Openssh Openbsd
7.5
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Authenticate to sshd with valid credentials
  2. Delivery
    Identify DisableForwarding=yes with PermitTunnel=yes
  3. Exploit
    Request tun tunnel via ssh -w
  4. Execution
    Override fails, tunnel established
  5. Impact
    Pivot into restricted network segment

Vulnerability Assessment

Weakness
CWE
CWE-348
ASVS 5.0
V6 - Authentication IP-independent access control
Exploitation Conditions

Exploitation requires that the server run sshd with BOTH DisableForwarding=yes AND PermitTunnel=yes (point-to-point or ethernet) simultaneously - a non-default configuration where the administrator intended forwarding to be off but explicitly permitted tunneling. The attacker must also have a valid authenticated SSH session on the host and sufficient privileges/setup to bring up a tun interface (typically root or CAP_NET_ADMIN on both ends for tun device creation). What limits exploitation: it is inert on default configurations (DisableForwarding is not set by default), inert if PermitTunnel is left at its default of no, and it grants no code execution - only the tunnel/forwarding capability the policy tried to remove. It affects only OpenSSH versions before 10.4.
Impact

The signals are consistent and point to a low-to-moderate real-world priority despite the 7.5 CVSS. SSVC scores Exploitation=none, Automatable=no, Technical Impact=partial, and EPSS is 0.13% (3rd percentile) - all indicating this is not a mass-exploitation target. The published CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/C:N/I:H/A:N) appears overstated: PR:N implies no authentication, but establishing an SSH tunnel requires a valid authenticated session, so PR:L is more defensible, and I:H overstates impact for a forwarding-restriction bypass whose consequence is unauthorized network reachability rather than direct data tampering. Critically, exploitation only matters where an administrator explicitly set DisableForwarding=yes while leaving PermitTunnel=yes - a non-default, self-contradictory configuration - so the exposed population is narrow. This is a hardening/defense-in-depth failure, not a remote code execution or unauthenticated compromise.
Exploit ScenarioDerived

An administrator hardens a bastion with DisableForwarding=yes but leaves PermitTunnel=yes in a shared config, believing all forwarding is off. An authenticated user with SSH access to that host requests a tun tunnel (ssh -w) and, because the override fails, successfully establishes a layer-3 tunnel into networks the policy intended to seal off, enabling pivoting. No public exploit is required - this uses stock ssh tunnel functionality against a misconfigured-but-believed-safe server.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv3 – Jul 09, 2026

Security-control bypass in OpenSSH sshd before 10.4 causes the DisableForwarding=yes hardening directive to be silently ignored when PermitTunnel=yes is also set, so tun-device forwarding remains available despite an administrator's explicit policy to disable all forwarding. Affected operators are those who rely on DisableForwarding as a defense-in-depth restriction; the flaw lets an authenticated user establish layer-2/3 tunnels the configuration was meant to forbid. There is no public exploit identified at time of analysis, EPSS is low (0.13%, 3rd percentile), and it is not on CISA KEV.

Earlier versions of this analysis (2)
v2 Jul 09, 2026 - 17:13 cvss changed CVSS 7.5

Forwarding-restriction bypass in OpenSSH sshd before 10.4 allows tunnel (tun-device) forwarding to remain active even when an administrator sets DisableForwarding=yes, because that directive failed to override an explicit PermitTunnel=yes. Affected operators believe they have hardened the daemon against all forwarding, yet layer-2/layer-3 tunneling still functions, undermining a deliberately configured security control. There is no public exploit identified at time of analysis; EPSS is low (0.13%, 3rd percentile) and CISA SSVC records no observed exploitation.

v1 Jul 08, 2026 - 01:26 CVSS 5.9

Tunnel enforcement in OpenSSH sshd before 10.4 is broken when DisableForwarding=yes and PermitTunnel=yes coexist in the configuration: the intended precedence of the blanket forwarding block is silently ignored, and PermitTunnel wins. Authenticated SSH users on such systems can establish layer-3 VPN-like tunnels the administrator explicitly meant to prohibit, enabling network pivoting through the SSH server. No public exploit code has been identified at time of analysis, no KEV listing exists, and the fix is available in OpenSSH 10.4p1.

RemediationAI

Vendor-released patch: upgrade sshd to OpenSSH 10.4 (portable 10.4p1) or later per the release notes at https://www.openssh.com/releasenotes.html#10.4p1, which corrects the precedence so DisableForwarding=yes overrides PermitTunnel. Until you can patch, the effective workaround is to stop relying on DisableForwarding alone to block tunneling and instead explicitly set PermitTunnel=no in sshd_config (and reload sshd), which directly disables the tun-forwarding path rather than depending on the broken override; the trade-off is only that any legitimate tunnel users must be re-enabled selectively. As a compensating network control, block or filter the tun/point-to-point interfaces and restrict which authenticated accounts can reach sshd (Match blocks, firewall rules on internal segments) to limit pivoting, accepting that this adds configuration overhead. Validate with a test connection that tunnel setup is refused after the change.

Affected VersionsENISA

OpenSSH 0 <10.4

Affected Packages

euvd openssh fix: 10.4

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

OpenSSH's sshd supports tun(4)-based VPN-style forwarding controlled by PermitTunnel, and a broader DisableForwarding switch introduced as a blanket kill-switch for all forwarding types (TCP, X11, agent, StreamLocal, and tunnel). The intended precedence is that DisableForwarding=yes overrides any more permissive per-feature directive, including PermitTunnel. The bug is a precedence/enforcement gap in how sshd evaluates these options: the tunnel path did not consult the DisableForwarding master switch. This maps to CWE-348 (Use of Less Trusted Source / reliance on the wrong source of authority) because sshd honored the less-authoritative PermitTunnel setting instead of the higher-authority DisableForwarding policy. CPE cpe:2.3:a:openbsd:openssh:*:*:* identifies portable and OpenBSD OpenSSH prior to 10.4p1.

Know when Openssh gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (mitre) PRIMARY MEDIUM
NVD 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
vuln.today AI 4.3 LOW

Establishing a tunnel needs an authenticated session (PR:L) and a non-default config; impact is bypassing a forwarding restriction to gain network reachability (I:L), with no direct confidentiality or availability loss.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
SUSE 5.9 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Red Hat 5.9 MEDIUM

Primary rating from Vendor (mitre).

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None

Lifecycle Timeline

5
Analysis Updated
Jul 09, 2026 - 17:13 vuln.today
v3 - CVSS changed
Analysis Updated
Jul 09, 2026 - 17:13 vuln.today
v2 - CVSS changed
Severity Changed
Jul 09, 2026 - 17:07 NVD
MEDIUM HIGH
CVSS changed
Jul 09, 2026 - 17:07 NVD
5.9 (MEDIUM) 7.5 (HIGH)
Patch available
Jul 08, 2026 - 02:01 EUVD

DescriptionNVD

In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.

Executive ViewAI

Why It Matters

OpenSSH sshd versions before 10.4 contain a configuration-bypass flaw that defeats intended SSH hardening directives, allowing tunnel-based access despite explicit administrator restrictions. No public exploitation has been reported, though the vulnerability is readily exploitable by any authenticated user on affected systems. Organizations relying on SSH-based network segmentation must prioritize deployment of version 10.4 or later to restore intended access-control enforcement.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.1%
Top 97% exploitable
Prevalence
Ubiquitous
OpenSSH is the de facto SSH server across nearly all Unix/Linux systems
Social Media
1
Sightings
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment MSRC Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact
High
Technical Impact
Partial

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Related Vulnerabilities in OpenSSH File Transfer and Auth Security Flaws

View all 8
CVE-2026-60000 HIGH
7.5
CVE-2026-60001 MEDIUM
6.5
CVE-2026-59995 MEDIUM POC
5.4
CVE-2026-60002 CRITICAL
9.4
CVE-2026-59996 MEDIUM
5.4
CVE-2026-59997 MEDIUM
5.4
CVE-2026-59998 MEDIUM
6.5

More in Openssh

View all
CVE-2023-38408 CRITICAL POC
9.8 Jul 20

The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remot
CVE-2023-25136 MEDIUM POC
6.5 Feb 03

OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. Rated medium se
CVE-2016-6210 MEDIUM POC
5.9 Feb 13

sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static

CVE-2015-5600 HIGH POC
8.1 Aug 03

The kbdint_next_device function in auth2-chall.c in sshd in OpenSSH through 6.9 does not properly restrict the processin
CVE-2016-6515 HIGH POC
7.5 Aug 07

The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password a
CVE-2026-123158 HIGH POC
8.1 Nov 05

Password authentication bypass in OpenSSH sshd before 10.6p2 built against musl libc without PAM lets a remote, unauthen
CVE-2024-6387 HIGH POC
8.1 Jul 01

Remote code execution in OpenSSH's sshd server (regression of CVE-2006-5051) allows unauthenticated remote attackers to

CVE-2019-6111 MEDIUM POC
5.9 Jan 31

An issue was discovered in OpenSSH 7.9. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no
CVE-2025-26465 MEDIUM
6.8 Feb 18

A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. Rated medium severity (CVSS 6.8), this
CVE-2023-48795 MEDIUM POC
5.9 Dec 18

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remot
CVE-2016-0777 MEDIUM
6.5 Jan 14

The resend_bytes function in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2 allows remote serv
CVE-2016-3115 MEDIUM POC
6.4 Mar 22

Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH before 7.2p2 allow remote authenticated users to

Same weakness CWE-348 – Use of Less Trusted Source

View all
CVE-2022-31813 CRITICAL POC
9.8
CVE-2026-43634 HIGH POC
8.7
CVE-2025-55292 HIGH POC
8.2
CVE-2021-21374 HIGH POC
8.1
CVE-2022-2255 HIGH POC
7.5
CVE-2026-107271 MEDIUM POC
6.9
CVE-2026-61589 MEDIUM POC
6.3
CVE-2026-48772 CRITICAL
10.0

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP6-CHOST-BYOS Affected
SLES15-SP6-CHOST-BYOS-Aliyun Affected
SLES15-SP6-CHOST-BYOS-Azure Affected
SLES15-SP6-CHOST-BYOS-EC2 Affected

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:37382 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-59999 ADVISORY https://ubuntu.com/security/notices/USN-8533-1 ADVISORY https://vuldb.com/vuln/376759 REF https://marc.info/?l=openssh-unix-dev&m=178333966933090&w=2 REF https://www.openssh.org/releasenotes.html#10.4p1 REF https://www.openwall.com/lists/oss-security/2026/07/06/5

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy