EUVD-2026-94048
GHSA-8fmq-pfxf-6hmc
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L
Triggering the bug requires control over sshd configuration (PR:H) and a specific non-default 'none' value (AC:H); local vector only, no confidentiality impact, limited integrity/availability.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
5DescriptionCVE.org
In sshd in OpenSSH before 10.6, the value "none" for a configuration option is sometimes interpreted as a filename but was intended to mean that a feature is disabled.
AnalysisAI
Misinterpretation of the literal configuration value "none" in sshd in OpenSSH before 10.6 causes the daemon to treat the keyword as a filename instead of as a feature-disable value, yielding limited integrity and availability impact with no confidentiality loss. Per our independent assessment this is a low-severity, low-priority issue despite being in ubiquitous software: exploitation is local only (AV:L), requires high attack complexity (AC:H) and high privileges (PR:H), and depends entirely on an administrator having set an sshd option to the literal string "none" in a non-default configuration, so there is no remote or default-configuration exposure. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a specific non-default configuration in which an operator sets an sshd option to the literal string 'none' expecting the feature to be disabled; sshd then treats 'none' as a filename. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a low-severity, low-priority issue despite being in ubiquitous software. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The vendor fix is OpenSSH 10.6 or later, per the upstream release notes (https://www.openssh.org/releasenotes.html#10.6) - Vendor-released patch: OpenSSH 10.6. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, whi
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
freeSSHd.exe in freeSSHd through 1.2.6 allows remote attackers to bypass authentication via a crafted session, as demons
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, whi
OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. Rated medium se
sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static
The kbdint_next_device function in auth2-chall.c in sshd in OpenSSH through 6.9 does not properly restrict the processin
The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password a
Remote code execution in OpenSSH's sshd server (regression of CVE-2006-5051) allows unauthenticated remote attackers to
The SSH USERAUTH CHANGE REQUEST feature in SSH Tectia Server 6.0.4 through 6.0.20, 6.1.0 through 6.1.12, 6.2.0 through 6
A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. Rated medium severity (CVSS 6.8), this
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today