Skip to main content

OpenSSH EUVDEUVD-2026-18398

| CVE-2026-35385 HIGH
Improper Preservation of Permissions (CWE-281)
2026-04-02 mitre GHSA-jgqr-738j-43cg
8.1
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
8.1 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.5 HIGH

Attacker needs no local privileges (PR:N) but root must actively run scp with legacy -O and no -p against a hostile source, so UI:R and AC:H; setuid-root outcome yields full C/I/A impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
7.5 HIGH
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Red Hat
7.5 HIGH
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

13
Analysis Updated
Jun 30, 2026 - 04:40 vuln.today
v6 (cvss_changed)
Analysis Updated
Jun 30, 2026 - 04:40 vuln.today
v5 (cvss_changed)
Analysis Updated
Jun 30, 2026 - 04:39 vuln.today
v4 (cvss_changed)
Analysis Updated
Jun 30, 2026 - 04:38 vuln.today
v3 (cvss_changed)
CVSS changed
Jun 30, 2026 - 03:24 NVD
7.5 (HIGH) 8.1 (HIGH)
Analysis Updated
Apr 27, 2026 - 14:14 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Apr 27, 2026 - 14:07 vuln.today
cvss_changed
Analysis Updated
Apr 16, 2026 - 06:08 EUVD-patch-fix
executive_summary
Re-analysis Queued
Apr 16, 2026 - 05:29 backfill_euvd_patch
patch_released
Patch available
Apr 16, 2026 - 05:29 EUVD
10.3
EUVD ID Assigned
Apr 02, 2026 - 17:00 euvd
EUVD-2026-18398
Analysis Generated
Apr 02, 2026 - 17:00 vuln.today
CVE Published
Apr 02, 2026 - 16:30 nvd
HIGH 7.5

DescriptionNVD

In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O (legacy scp protocol) and without -p (preserve mode).

AnalysisAI

Privilege-escalation exposure in OpenSSH before 10.3 (fixed in 10.3p1) where scp, when run by root using the legacy SCP protocol flag -O and without -p (preserve mode), may write a downloaded file with setuid or setgid bits set, contrary to user expectation. A malicious or compromised SSH server (or a man-in-the-middle on the transfer) could thereby cause an attacker-controlled binary to land on disk as a setuid/setgid-root executable, enabling local privilege escalation when it is later run. There is no public exploit identified at time of analysis, EPSS is very low (0.04%), and CISA SSVC rates exploitation as 'none' though technical impact as 'total'.

Technical ContextAI

OpenSSH's scp historically used the legacy SCP/RCP wire protocol, selectable via the -O flag after newer releases defaulted to SFTP. In that legacy mode the remote side transmits file metadata including permission bits. Normally scp only honors transmitted modes when -p (preserve) is requested; the defect (CWE-281, Improper Preservation of Permissions) is that under the specific combination of running as root with -O and without -p, the setuid (04000) and setgid (02000) bits can be applied to the resulting local file even though the user did not ask to preserve modes. The affected component is the OpenBSD OpenSSH client (cpe:2.3:a:openbsd:openssh) across all versions below 10.3. Because setuid/setgid-root binaries execute with elevated privileges regardless of the invoking user, an unexpectedly setuid file sourced from an untrusted server becomes a direct privilege-escalation primitive.

RemediationAI

Vendor-released patch: upgrade to OpenSSH 10.3 / 10.3p1 or later (per https://www.openssh.org/releasenotes.html#10.3p1), or apply your distribution's fixed package - Ubuntu USN-8222-1 and the Red Hat RHSA errata listed above deliver the backported fix. Until patched, the practical compensating controls map directly to the trigger conditions: avoid using the legacy SCP protocol flag -O when running scp as root, since the modern SFTP-based default transfer is not affected (trade-off: scripts pinned to -O for compatibility with old servers must be reviewed); do not run scp as root against untrusted or third-party servers, instead pull files as an unprivileged user and chown/chmod afterward; and if -O must be used, always pass -p so mode handling is explicit, or post-process downloads to strip setuid/setgid bits (e.g. chmod a-st on the destination) before any execution. Auditing for unexpected setuid/setgid files (find / -perm -4000 -o -perm -2000) is advisable on hosts where root-initiated legacy scp downloads may have already occurred.

More in SSH

View all
CVE-2014-6271 CRITICAL POC
9.8 Sep 24

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which

CVE-2014-6278 HIGH POC
8.8 Sep 30

GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, whi

CVE-2014-7169 CRITICAL POC
9.8 Sep 25

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of

CVE-2012-6066 CRITICAL POC
9.3 Dec 04

freeSSHd.exe in freeSSHd through 1.2.6 allows remote attackers to bypass authentication via a crafted session, as demons

CVE-2014-6277 CRITICAL POC
10.0 Sep 27

GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, whi

CVE-2023-25136 MEDIUM POC
6.5 Feb 03

OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. Rated medium se

CVE-2016-6210 MEDIUM POC
5.9 Feb 13

sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static

CVE-2015-5600 HIGH POC
8.1 Aug 03

The kbdint_next_device function in auth2-chall.c in sshd in OpenSSH through 6.9 does not properly restrict the processin

CVE-2016-6515 HIGH POC
7.5 Aug 07

The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password a

CVE-2024-6387 HIGH POC
8.1 Jul 01

Remote code execution in OpenSSH's sshd server (regression of CVE-2006-5051) allows unauthenticated remote attackers to

CVE-2012-5975 CRITICAL POC
9.3 Dec 04

The SSH USERAUTH CHANGE REQUEST feature in SSH Tectia Server 6.0.4 through 6.0.20, 6.1.0 through 6.1.12, 6.2.0 through 6

CVE-2023-48795 MEDIUM POC
5.9 Dec 18

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remot

Vendor StatusVendor

SUSE

Severity: High
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Fixed
SLES15-SP6-CHOST-BYOS Fixed
SLES15-SP6-CHOST-BYOS-Aliyun Fixed
SLES15-SP6-CHOST-BYOS-Azure Fixed
SLES15-SP6-CHOST-BYOS-EC2 Fixed

Share

EUVD-2026-18398 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy