Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Establishing a tunnel needs an authenticated session (PR:L) and a non-default config; impact is bypassing a forwarding restriction to gain network reachability (I:L), with no direct confidentiality or availability loss.
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Primary rating from Vendor (mitre).
CVSS VectorNVD
Lifecycle Timeline
7DescriptionNVD
In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.
AnalysisAI
Security-control bypass in OpenSSH sshd before 10.4 causes the DisableForwarding=yes hardening directive to be silently ignored when PermitTunnel=yes is also set, so tun-device forwarding remains available despite an administrator's explicit policy to disable all forwarding. Affected operators are those who rely on DisableForwarding as a defense-in-depth restriction; the flaw lets an authenticated user establish layer-2/3 tunnels the configuration was meant to forbid. There is no public exploit identified at time of analysis, EPSS is low (0.13%, 3rd percentile), and it is not on CISA KEV.
Technical ContextAI
OpenSSH's sshd supports tun(4)-based VPN-style forwarding controlled by PermitTunnel, and a broader DisableForwarding switch introduced as a blanket kill-switch for all forwarding types (TCP, X11, agent, StreamLocal, and tunnel). The intended precedence is that DisableForwarding=yes overrides any more permissive per-feature directive, including PermitTunnel. The bug is a precedence/enforcement gap in how sshd evaluates these options: the tunnel path did not consult the DisableForwarding master switch. This maps to CWE-348 (Use of Less Trusted Source / reliance on the wrong source of authority) because sshd honored the less-authoritative PermitTunnel setting instead of the higher-authority DisableForwarding policy. CPE cpe:2.3:a:openbsd:openssh:*:*:* identifies portable and OpenBSD OpenSSH prior to 10.4p1.
RemediationAI
Vendor-released patch: upgrade sshd to OpenSSH 10.4 (portable 10.4p1) or later per the release notes at https://www.openssh.com/releasenotes.html#10.4p1, which corrects the precedence so DisableForwarding=yes overrides PermitTunnel. Until you can patch, the effective workaround is to stop relying on DisableForwarding alone to block tunneling and instead explicitly set PermitTunnel=no in sshd_config (and reload sshd), which directly disables the tun-forwarding path rather than depending on the broken override; the trade-off is only that any legitimate tunnel users must be re-enabled selectively. As a compensating network control, block or filter the tun/point-to-point interfaces and restrict which authenticated accounts can reach sshd (Match blocks, firewall rules on internal segments) to limit pivoting, accepting that this adds configuration overhead. Validate with a test connection that tunnel setup is refused after the change.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, whi
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
freeSSHd.exe in freeSSHd through 1.2.6 allows remote attackers to bypass authentication via a crafted session, as demons
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, whi
OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. Rated medium se
sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static
The kbdint_next_device function in auth2-chall.c in sshd in OpenSSH through 6.9 does not properly restrict the processin
The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password a
Remote code execution in OpenSSH's sshd server (regression of CVE-2006-5051) allows unauthenticated remote attackers to
The SSH USERAUTH CHANGE REQUEST feature in SSH Tectia Server 6.0.4 through 6.0.20, 6.1.0 through 6.1.12, 6.2.0 through 6
A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. Rated medium severity (CVSS 6.8), this
Same weakness CWE-348 – Use of Less Trusted Source
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SLES15-SP5-CHOST-BYOS-SAP-CCloud | Affected |
| SLES15-SP6-CHOST-BYOS | Affected |
| SLES15-SP6-CHOST-BYOS-Aliyun | Affected |
| SLES15-SP6-CHOST-BYOS-Azure | Affected |
| SLES15-SP6-CHOST-BYOS-EC2 | Affected |
| SLES15-SP6-CHOST-BYOS-GCE | Affected |
| SLES15-SP6-CHOST-BYOS-GDC | Affected |
| SLES15-SP6-CHOST-BYOS-SAP-CCloud | Affected |
| SLES15-SP7-CHOST-BYOS-Aliyun | Affected |
| SLES15-SP7-CHOST-BYOS-Azure | Affected |
| SLES15-SP7-CHOST-BYOS-EC2 | Affected |
| SLES15-SP7-CHOST-BYOS-GCE | Affected |
| SLES15-SP7-CHOST-BYOS-GDC | Affected |
| SLES15-SP7-CHOST-BYOS-SAP-CCloud | Affected |
| SUSE Linux Enterprise Desktop 15 SP7 | Affected |
| SUSE Linux Enterprise High Performance Computing 15 SP7 | Affected |
| SUSE Linux Enterprise Micro 5.3 | Affected |
| SUSE Linux Enterprise Micro 5.4 | Affected |
| SUSE Linux Enterprise Micro 5.5 | Affected |
| SUSE Linux Enterprise Module for Basesystem 15 SP7 | Affected |
| SUSE Linux Enterprise Module for Desktop Applications 15 SP7 | Affected |
| SUSE Linux Enterprise Server 15 SP7 | Affected |
| SUSE Linux Enterprise Server 16.0 | Affected |
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP7 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.0 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Micro 6.0 | Affected |
| SUSE Linux Micro 6.1 | Affected |
| SUSE Linux Micro 6.2 | Affected |
| openSUSE Leap 16.0 | Affected |
| SLES15-SP3-CHOST-BYOS-Aliyun | Affected |
| SLES15-SP3-CHOST-BYOS-Azure | Affected |
| SLES15-SP3-CHOST-BYOS-EC2 | Affected |
| SLES15-SP3-CHOST-BYOS-GCE | Affected |
| SLES15-SP3-CHOST-BYOS-SAP-CCloud | Affected |
| SLES15-SP4-CHOST-BYOS | Affected |
| SLES15-SP4-CHOST-BYOS-Aliyun | Affected |
| SLES15-SP4-CHOST-BYOS-Azure | Affected |
| SLES15-SP4-CHOST-BYOS-EC2 | Affected |
| SLES15-SP4-CHOST-BYOS-GCE | Affected |
| SLES15-SP4-CHOST-BYOS-SAP-CCloud | Affected |
| SLES15-SP5-CHOST-BYOS-Aliyun | Affected |
| SLES15-SP5-CHOST-BYOS-Azure | Affected |
| SLES15-SP5-CHOST-BYOS-EC2 | Affected |
| SLES15-SP5-CHOST-BYOS-GCE | Affected |
| SLES15-SP5-CHOST-BYOS-GDC | Affected |
| SUSE Linux Enterprise High Performance Computing 15 SP4 | Affected |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | Affected |
| SUSE Linux Enterprise High Performance Computing 15 SP5 | Affected |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | Affected |
| SUSE Linux Enterprise Module for Basesystem 15 SP4 | Affected |
| SUSE Linux Enterprise Module for Basesystem 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Basesystem 15 SP6 | Affected |
| SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME CORE | Affected |
| SUSE Linux Enterprise Server 12 SP5 | Affected |
| SUSE Linux Enterprise Server 12 SP5 | Affected |
| SUSE Linux Enterprise Server 12 SP5-LTSS | Affected |
| SUSE Linux Enterprise Server 12 SP5-LTSS | Affected |
| SUSE Linux Enterprise Server 12 SP5-LTSS Extended Security | Affected |
| SUSE Linux Enterprise Server 12 SP5-LTSS Extended Security | Affected |
| SUSE Linux Enterprise Server 15 SP4 | Affected |
| SUSE Linux Enterprise Server 15 SP4-LTSS | Affected |
| SUSE Linux Enterprise Server 15 SP5 | Affected |
| SUSE Linux Enterprise Server 15 SP5-LTSS | Affected |
| SUSE Linux Enterprise Server 15 SP6 | Affected |
| SUSE Linux Enterprise Server 15 SP6-LTSS | Affected |
| SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 | Affected |
| SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | Affected |
| SUSE Manager Proxy 4.3 | Affected |
| SUSE Manager Proxy LTS 4.3 | Affected |
| SUSE Manager Retail Branch Server 4.3 | Affected |
| SUSE Manager Retail Branch Server LTS 4.3 | Affected |
| SUSE Manager Server 4.3 | Affected |
| SUSE Manager Server LTS 4.3 | Affected |
| SUSE CaaS Platform 3.0 | Affected |
| SUSE CaaS Platform 4.0 | Affected |
| SUSE Enterprise Storage 6 | Affected |
| SUSE Enterprise Storage 7 | Affected |
| SUSE Enterprise Storage 7.1 | Affected |
| SUSE Linux Enterprise Desktop 11 SP4 | Affected |
| SUSE Linux Enterprise Desktop 12 SP2 | Affected |
| SUSE Linux Enterprise Desktop 12 SP3 | Affected |
| SUSE Linux Enterprise Desktop 12 SP4 | Affected |
| SUSE Linux Enterprise Desktop 15 SP1 | Affected |
| SUSE Linux Enterprise Desktop 15 SP2 | Affected |
| SUSE Linux Enterprise Desktop 15 SP3 | Affected |
| SUSE Linux Enterprise Desktop 15 SP4 | Affected |
| SUSE Linux Enterprise Desktop 15 SP5 | Affected |
| SUSE Linux Enterprise Desktop 15 SP6 | Affected |
| SUSE Linux Enterprise High Performance Computing 15 SP1 | Affected |
| SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS | Affected |
| SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS | Affected |
| SUSE Linux Enterprise High Performance Computing 15 SP2 | Affected |
| SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS | Affected |
| SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS | Affected |
| SUSE Linux Enterprise High Performance Computing 15 SP3 | Affected |
| SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS | Affected |
| SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS | Affected |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | Affected |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | Affected |
| SUSE Linux Enterprise High Performance Computing 15 SP6 | Affected |
| SUSE Linux Enterprise Micro 5.0 | Affected |
| SUSE Linux Enterprise Micro 5.1 | Affected |
| SUSE Linux Enterprise Micro 5.2 | Affected |
| SUSE Linux Enterprise Module for Basesystem 15 SP1 | Affected |
| SUSE Linux Enterprise Module for Basesystem 15 SP2 | Affected |
| SUSE Linux Enterprise Module for Basesystem 15 SP3 | Affected |
| SUSE Linux Enterprise Module for Server Applications 15 SP1 | Affected |
| SUSE Linux Enterprise Module for Server Applications 15 SP2 | Affected |
| SUSE Linux Enterprise Module for Server Applications 15 SP3 | Affected |
| SUSE Linux Enterprise Point of Sale 12 SP2-CLIENT | Affected |
| SUSE Linux Enterprise Real Time 15 SP2 | Affected |
| SUSE Linux Enterprise Real Time 15 SP3 | Affected |
| SUSE Linux Enterprise Real Time 15 SP4 | Affected |
| SUSE Linux Enterprise Server 11 SP4 | Affected |
| SUSE Linux Enterprise Server 11 SP4-LTSS | Affected |
| SUSE Linux Enterprise Server 12 SP2 | Affected |
| SUSE Linux Enterprise Server 12 SP2-BCL | Affected |
| SUSE Linux Enterprise Server 12 SP2-ESPOS | Affected |
| SUSE Linux Enterprise Server 12 SP2-LTSS | Affected |
| SUSE Linux Enterprise Server 12 SP3 | Affected |
| SUSE Linux Enterprise Server 12 SP3-BCL | Affected |
| SUSE Linux Enterprise Server 12 SP3-ESPOS | Affected |
| SUSE Linux Enterprise Server 12 SP3-LTSS | Affected |
| SUSE Linux Enterprise Server 12 SP4 | Affected |
| SUSE Linux Enterprise Server 15 SP1 | Affected |
| SUSE Linux Enterprise Server 15 SP1-BCL | Affected |
| SUSE Linux Enterprise Server 15 SP1-LTSS | Affected |
| SUSE Linux Enterprise Server 15 SP2 | Affected |
| SUSE Linux Enterprise Server 15 SP2-BCL | Affected |
| SUSE Linux Enterprise Server 15 SP2-LTSS | Affected |
| SUSE Linux Enterprise Server 15 SP3 | Affected |
| SUSE Linux Enterprise Server 15 SP3-BCL | Affected |
| SUSE Linux Enterprise Server 15 SP3-LTSS | Affected |
| SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 12 SP2 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 12 SP3 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP1 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP2 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP3 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | Affected |
| SUSE Manager Proxy 4.0 | Affected |
| SUSE Manager Proxy 4.1 | Affected |
| SUSE Manager Proxy 4.2 | Affected |
| SUSE Manager Retail Branch Server 4.0 | Affected |
| SUSE Manager Retail Branch Server 4.1 | Affected |
| SUSE Manager Retail Branch Server 4.2 | Affected |
| SUSE Manager Server 4.0 | Affected |
| SUSE Manager Server 4.1 | Affected |
| SUSE Manager Server 4.2 | Affected |
| SUSE OpenStack Cloud 7 | Affected |
| SUSE OpenStack Cloud 8 | Affected |
| SUSE OpenStack Cloud Crowbar 8 | Affected |
| openSUSE Leap 15.3 | Affected |
| openSUSE Leap 15.4 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
| openSUSE Leap Micro 5.2 | Affected |
| openSUSE Leap Micro 5.3 | Affected |
| openSUSE Leap Micro 5.4 | Affected |
| openSUSE Leap Micro 5.5 | Affected |
| SLES-CHOST-BYOS-Aliyun | Affected |
| SLES-CHOST-BYOS-Azure | Affected |
| SLES-CHOST-BYOS-EC2 | Affected |
| SLES-CHOST-BYOS-GCE | Affected |
| SLES-CHOST-BYOS-GDC | Affected |
| SLES-CHOST-BYOS-SAP-CCloud | Affected |
| kiwi-templates-Minimal kiwi-templates-Minimal-Cloud-sap kiwi-templates-Minimal-MS-HyperV-sap kiwi-templates-Minimal-VMware-sap kiwi-templates-Minimal-kvm-and-xen-sap ses/7.1/cephcsi/cephcsi ses/7.1/rook/ceph ses/7/ceph/ceph ses/7/cephcsi/cephcsi ses/7/rook/ceph suse/hpc/warewulf4-x86_64/sle-hpc-node suse/manager/4.3/proxy-ssh suse/manager/5.0/x86_64/proxy-ssh suse/manager/5.0/x86_64/server suse/multi-linux-manager/5.1/x86_64/proxy-ssh suse/multi-linux-manager/5.1/x86_64/server suse/multi-linux-manager/5.2/x86_64/proxy-ssh suse/multi-linux-manager/5.2/x86_64/server suse/sle-micro-rancher/5.2 suse/sle-micro-rancher/5.3 suse/sle-micro-rancher/5.4 suse/sle-micro/5.5 trento/trento-runner | Affected |
Share
External POC / Exploit Code
Leaving vuln.today
EUVD-2026-42142
GHSA-gcm2-x6hm-q4h3