CVE-2026-35386

NameCVE-2026-35386
DescriptionIn OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line. This requires a scenario where the username on the command line is untrusted, and also requires a non-default configurations of % in ssh_config.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs1132573

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
openssh (PTS)bullseye1:8.4p1-5+deb11u3vulnerable
bullseye (security)1:8.4p1-5+deb11u6vulnerable
bookworm1:9.2p1-2+deb12u7vulnerable
bookworm (security)1:9.2p1-2+deb12u9vulnerable
trixie1:10.0p1-7+deb13u1vulnerable
trixie (security)1:10.0p1-7+deb13u2vulnerable
forky, sid1:10.3p1-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
opensshsource(unstable)1:10.3p1-11132573

Notes

[trixie] - openssh <no-dsa> (Minor issue)
[bookworm] - openssh <no-dsa> (Minor issue)
[bullseye] - openssh <no-dsa> (Minor issue)
https://www.openssh.org/releasenotes.html#10.3p1

Search for package or bug name: Reporting problems