EUVD-2026-46254
GHSA-fvwj-j79q-57v7
Severity by source
AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Local attack requiring low-privilege username control and user-initiated SSH connection; impact limited to environment variable disclosure and minor shell behavior alteration with no availability impact.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Lifecycle Timeline
1DescriptionCVE.org
A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables and causing unintended shell behavior.
AnalysisAI
Shell metacharacter injection in libssh's ProxyCommand handling allows a crafted SSH username to break out of the intended command string when the %r token is expanded. Affecting libssh deployments that use ProxyCommand with %r substitution, a low-privileged local attacker who controls the username passed to the connection can cause the shell executing the ProxyCommand to expand environment variables or alter its behavior, leaking sensitive environment data. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent conditions: (1) the target application must use libssh's ProxyCommand functionality with the %r remote-username token in the command template - configurations not using ProxyCommand or not using %r are not affected; (2) the attacker must control or influence the SSH username supplied to the libssh connection, either directly (e.g., as a local user running an SSH client) or indirectly through an application that forwards user-supplied usernames to libssh; (3) a legitimate user must actively initiate the SSH connection (UI:R), meaning passive or automated exploitation without user action is not possible. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N, score 3.9) places this firmly in the Low band. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local attacker crafts an SSH username containing shell metacharacters such as $(printenv) or $AWS_SECRET_ACCESS_KEY and presents this username to an application using libssh with a ProxyCommand that includes %r. When a legitimate user initiates an SSH connection through that configuration, libssh expands %r into the crafted username without sanitization, causing the shell executing the ProxyCommand to evaluate the injected expression and potentially write environment variable contents to a location the attacker can read. … |
| Remediation | Apply the vendor-released patch for libssh as distributed through the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-59846; the exact fixed version is not independently confirmed from the available data, and the Bugzilla entry at https://bugzilla.redhat.com/show_bug.cgi?id=2498179 should be monitored for fix version confirmation. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remot
A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. Rated critical severity
libssh 0.9.4 has a NULL pointer dereference in tftpserver.c if ssh_buffer_new returns NULL. Rated medium severity (CVSS
Multiple integer overflows in libssh before 0.5.3 allow remote attackers to cause a denial of service (infinite loop or
Multiple buffer overflows in libssh before 0.5.3 allow remote attackers to cause a denial of service (crash) or possibly
Cryptographic key derivation failure in libssh versions prior to 0.11.2 (when built against OpenSSL older than 3.0) can
A flaw was found with the libssh API function ssh_scp_new() in versions before 0.9.3 and before 0.8.8. Rated high severi
A flaw was found in libssh when using the ChaCha20 cipher with the OpenSSL library.
The (1) SSH_MSG_NEWKEYS and (2) SSH_MSG_KEXDH_REPLY packet handlers in package_cb.c in libssh before 0.6.5 do not proper
Double free vulnerability in the sftp_mkdir function in sftp.c in libssh before 0.5.3 allows remote attackers to cause a
Multiple double free vulnerabilities in the (1) agent_sign_data function in agent.c, (2) channel_request function in cha
Stack-based buffer overflow in libssh's SFTP server allows a connected client to crash the server or potentially execute
Same weakness CWE-77 – Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today