OpenSSH EUVD-2026-94055

Exploitation is confined to OpenSSH (sshd) running on environments that lack file-descriptor passing and unprivileged PTY device allocation - the description names QNX 6 and SCO OpenServer 5 specifically - and requires the GatewayPorts or StreamLocalForwarding configuration options to be in use. On such a host, sshd-session can retain root privileges instead of running unprivileged. Limiting factors sharply reduce real-world risk: the affected platforms are obsolete and rarely deployed, the attack vector is local (AV:L) with high complexity (AC:H), the config options are not universally enabled, and establishing the relevant forwarding/session behavior in practice presumes session access despite the input vector's PR:N.

This is a genuinely low-priority issue by every available signal, not a high-CVSS alarm. The input CVSS base score is 2.9 (Low) with vector CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - local attack vector, high attack complexity, no confidentiality or availability impact and only low integrity impact. There is NO EPSS score provided, NO CISA KEV listing, NO public POC, and NO SSVC decision data in the input, so exploitation-probability and automatability cannot be quantified from the data given. One internal tension is worth flagging: the input vector lists PR:N (unauthenticated) even though the weakness (CWE-272, improper privilege management) is tied to specific configuration options (GatewayPorts, StreamLocalForwarding) and to establishing SSH sessions/forwardings - behavior that normally presumes an authenticated session - so the PR:N labeling should be verified with the vendor; the flaw reads more like a privilege-separation weakening than a directly reachable unauthenticated bug. Critically, the condition only manifests on legacy niche platforms (QNX 6 and SCO OpenServer 5) that lack file-descriptor passing and unprivileged PTY allocation, so despite OpenSSH's ubiquity the real-world exposure is extremely narrow. Net: no public exploit identified, low technical impact, and a tiny affected footprint - a low real-risk issue rather than an urgent priority.

On a legacy QNX 6 or SCO OpenServer 5 host running OpenSSH ≤10.6 with GatewayPorts or StreamLocalForwarding configured, the sshd-session process fails to drop to an unprivileged state and instead retains root, because these platforms lack fd-passing and unprivileged PTY allocation. An attacker who can establish a session and exercise the forwarding paths operates within a root-privileged session process, so any further compromise of that process yields root rather than a sandboxed user. No public exploit code is identified at time of analysis.