EUVD-2026-18398
GHSA-jgqr-738j-43cg
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Description
In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O (legacy scp protocol) and without -p (preserve mode).
Analysis
OpenSSH's legacy scp protocol (pre-10.3) can install downloaded files with elevated setuid/setgid permissions when root users transfer files with -O flag without -p. This enables privilege escalation vectors if attackers control file server content or conduct man-in-the-middle attacks (CVSS AV:N/AC:H/UI:R). …
Sign in for full analysis, threat intelligence, and remediation guidance.
Remediation
24 hours: Identify all systems running OpenSSH versions before 10.3 and audit scp usage by root accounts; disable scp where possible and document all legitimate root-level file transfer workflows. 7 days: Implement network-level protections (VPN, SSH key pinning, host verification) for any required root scp transfers; migrate to sftp or rsync where operationally feasible. …
Sign in for detailed remediation steps.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today