EUVD-2026-94050
GHSA-74g8-x9g6-gwmc
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Sandbox-loss is a defense-in-depth regression with no standalone effect, so AC:H (requires chaining) and PR:L; only limited integrity escape is plausible, hence C:N/I:L/A:N.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
4DescriptionCVE.org
In sshd in OpenSSH through 10.6, use of the macOS 27 (or later) SDK has the side effect of loss of sandboxing, which is potentially unexpected.
AnalysisAI
OpenSSH sshd builds compiled against the macOS 27 (or later) SDK silently lose their sandbox, removing a containment layer that normally limits the damage an attacker can do if they manage to compromise or corrupt the sshd process. Only OpenSSH through 10.6 built against that specific SDK is affected, which is far from the default configuration for Linux, BSD, or older-macOS deployments. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Applies only to sshd from OpenSSH 10.6 or earlier that is compiled against the macOS 27 (or later) SDK; on such builds the expected sandbox is silently not applied. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a low-severity defense-in-depth regression, not a directly exploitable flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch was identified at time of analysis, so the primary action is to rebuild OpenSSH sshd against a macOS SDK version earlier than 27 where the sandbox is applied as expected, or confirm with the upstream maintainers via the release notes at https://www.openssh.org/releasenotes.html#10.6 whether a corrected build or configuration is available before trusting the current binary. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, whi
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
freeSSHd.exe in freeSSHd through 1.2.6 allows remote attackers to bypass authentication via a crafted session, as demons
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, whi
OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. Rated medium se
sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static
The kbdint_next_device function in auth2-chall.c in sshd in OpenSSH through 6.9 does not properly restrict the processin
The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password a
Remote code execution in OpenSSH's sshd server (regression of CVE-2006-5051) allows unauthenticated remote attackers to
The SSH USERAUTH CHANGE REQUEST feature in SSH Tectia Server 6.0.4 through 6.0.20, 6.1.0 through 6.1.12, 6.2.0 through 6
A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. Rated medium severity (CVSS 6.8), this
Same weakness CWE-653 – Improper Isolation or Compartmentalization
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today