CVE-2026-106588

openssh: OpenSSH: Loss of process sandboxing via macOS SDK builds

In sshd in OpenSSH through 10.6, use of the macOS 27 (or later) SDK has the side effect of loss of sandboxing, which is potentially unexpected.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Openbsd

Products

Openssh

CVE-2026-103547

LDAP Authentication Bypass via Reused File Descriptor and Message ID in OpenBSD ldapd

In ldapd in OpenBSD 7.8 before errata 057 and 7.9 before errata 021, delegated BSD authentication results are correlated only by the LDAP child process client file descriptor and LDAP message ID. After a connection closes, a later connection that reuses the same file descriptor and message ID can receive the earlier authentication result. A remote attacker who can reach ldapd can complete a Bind as another identity. A missing connection can also cause a NULL pointer dereference. (ldapd is not enabled by default.)

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Openbsd

Products

Openbsd

CVE-2026-35385

OpenSSH: OpenSSH: Privilege escalation via scp legacy protocol when not preserving file mode

In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O (legacy scp protocol) and without -p (preserve mode).

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Openbsd

Products

Openssh

CVE-2026-73282

openssh: OpenSSH: Information disclosure and data corruption via use-after-free in ssh client

In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Openbsd

Products

Openssh

CVE-2026-73283

openssh: OpenSSH: Tunnel forwarding restriction bypass

In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.

CVSS 3.1 · 2.5 Low EPSS < 1% KEV · Not listed

Vendors

Openbsd

Products

Openssh

CVE-2026-73281

openssh: OpenSSH: ssh-agent allows remote execution of local operations

In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the session-bind@openssh.com extension.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Openbsd

Products

Openssh

CVE-2026-59996

openssh: OpenSSH: `scp` file misplacement vulnerability during remote copy

scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs between two remote destinations.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed

Vendors

Openbsd

Products

Openssh

CVE-2026-59998

openssh: OpenSSH: Undocumented GSSAPIStrictAcceptorCheck behavior impacts security in Windows Active Directory

sshd in OpenSSH before 10.4 has an undocumented security-relevant behavior: GSSAPIStrictAcceptorCheck has no value if the server is in Windows Active Directory.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Openbsd

Products

Openssh

CVE-2026-59999

openssh: OpenSSH sshd: Security bypass due to incorrect handling of forwarding and tunneling options

In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Openbsd

Products

Openssh

CVE-2026-60000

openssh: OpenSSH: Denial of Service via excessive GSSAPI authentication attempts

sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service (resource consumption from excessive authentication attempts) because MaxAuthTries was mishandled for GSSAPIAuthentication.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Openbsd

Products

Openssh

CVE-2026-60001

openssh: OpenSSH: Brute-force attacks facilitated due to insufficient authentication delay

sshd in OpenSSH before 10.4 does not always honor the minimum authentication delay.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Openbsd

Products

Openssh

CVE-2026-60002

openssh: OpenSSH: Use-after-free vulnerability during host key re-exchange on the client side

ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. (This outcome occurs only on the client side.)

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Openbsd

Products

Openssh

CVE-2026-59995

openssh: OpenSSH: sftp client allows attacker to control downloaded file location

sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is used with an attacker-controlled server.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed

Vendors

Openbsd

Products

Openssh

CVE-2026-59997

openssh: OpenSSH: SFTP security bypass due to command-line argument parsing flaw

internal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line arguments, which can be important if a later command-line argument would have helped to ensure the intended security properties of an SFTP connection.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed

Vendors

Openbsd

Products

Openssh

CVE-2026-57589

OpenBSD Kernel Use‑After‑Free Enables Local Privilege Escalation

sys/kern/sysv_sem.c in OpenBSD through 7.9 has a use-after-free allowing local privilege escalation to root. This is a context switch use-after-free after tsleep in sys_semget().

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Openbsd

Products

Openbsd

CVE-2026-56099

OpenBSD mpls_do_error Kernel Stack Memory Disclosure via MPLS Input

OpenBSD before commit 6a23123 (2026-06-18) contains an out-of-bounds read vulnerability in the mpls_do_error function within sys/netmpls/mpls_input.c that allows remote attackers to disclose kernel stack memory by sending crafted MPLS frames with 16 labels and no Bottom-of-Stack bit set.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Openbsd

Products

Openbsd Src

CVE-2026-55706

Authentication Bypass via Zero-Length Input in sppp_pap

sppp_pap_input in sys/net/if_spppsubr.c in OpenBSD before 076e2b1 allows authentication bypass via certain zero values for lengths.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed

Vendors

Openbsd

Products

Openbsd

CVE-2016-8858

openssh: Memory exhaustion due to unregistered KEXINIT handler after receiving message

The kex_input_kexinit function in kex.c in OpenSSH 6.x and 7.x through 7.3 allows remote attackers to cause a denial of service (memory consumption) by sending many duplicate KEXINIT requests. NOTE: a third party reports that "OpenSSH upstream does not consider this as a security issue."

CVSS 3.1 · 7.5 High EPSS 29.5% KEV · Not listed

Vendors

Openbsd

Products

Openssh

CVE-2016-6210

openssh: User enumeration via covert timing channel

sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static password when the username does not exist, which allows remote attackers to enumerate users by leveraging the timing difference between responses when a large password is provided.

CVSS 3.1 · 5.9 Medium EPSS 88.9% KEV · Not listed

Vendors

Openbsd Redhat

Products

Openssh Enterprise Linux

CVE-2016-3115

openssh: missing sanitisation of input for X11 forwarding

Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH before 7.2p2 allow remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data, related to the (1) do_authenticated1 and (2) session_x11_req functions.

CVSS 3.1 · 6.4 Medium EPSS 35.5% KEV · Not listed

Vendors

Openbsd Oracle Redhat

Products

Openssh Vm Server Enterprise Linux