OpenSSH EUVD-2026-42138

Exploitation requires the scp copy to occur specifically in remote-to-remote (third-party) mode, where both the source and destination are remote hosts rather than the local client - this is a non-default and less common usage pattern. The CVSS UI:R metric confirms a user (or automated process acting as a user) must actively initiate the scp transfer. AC:H indicates the attacker must satisfy additional conditions beyond network reachability, specifically the ability to influence or control one of the two remote SSH endpoints involved in the transfer to return a maliciously crafted path. Standard scp invocations copying from a local machine to a remote host, or vice versa, are not described as affected. Authentication requirements are not applicable to the initiating user per PR:N in the CVSS vector, but the attacker must operate a reachable SSH endpoint that the victim's scp session connects to.

The CVSS 3.1 score of 4.2 (Medium) accurately reflects a vulnerability with meaningful real-world constraints. The vector AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L breaks down as: network reachable (AV:N) but requiring high attack complexity (AC:H), user-initiated transfer (UI:R), no confidentiality exposure (C:N), and only limited integrity and availability impact. The AC:H metric is significant - it implies the attacker must control or influence one of the remote SSH endpoints involved in the transfer, which is a non-trivial prerequisite. The UI:R metric further limits opportunistic exploitation; a user must actively initiate the scp remote-to-remote command. No EPSS data was provided in the source intelligence; no KEV listing is present; no POC exists at time of analysis. The practical risk is highest in automated pipeline or backup environments that script remote-to-remote scp transfers, especially where one of the remote hosts is not fully trusted. The absence of confidentiality impact (C:N) limits the intelligence-gathering value to an attacker; the primary concern is file placement integrity.

An attacker who controls a malicious SSH server could wait for a victim's automated backup or deployment script to invoke scp in remote-to-remote mode - for example, copying artifacts from a build host to that attacker-controlled server and then on to a second destination. The malicious server returns a crafted path response causing scp to write the transferred file one directory level above the intended destination, potentially overwriting a configuration file or executable in the parent path. No public exploit identified at time of analysis; the AC:H rating suggests exploitation is not trivially repeatable without control of a participating remote endpoint.