CVE-2026-106587

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-106587", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "state": "PUBLISHED", "assignerShortName": "mitre", "dateReserved": "2026-10-06T21:01:44.466Z", "datePublished": "2026-10-06T21:01:44.808Z", "dateUpdated": "2026-10-09T01:54:07.453Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "OpenSSH", "vendor": "OpenBSD", "versions": [{"lessThan": "10.6", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "In sshd in OpenSSH before 10.6, the value \"none\" for a configuration option is sometimes interpreted as a filename but was intended to mean that a feature is disabled."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.6, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-843", "description": "CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-10-06T21:01:44.808Z"}, "references": [{"url": "https://www.openssh.org/releasenotes.html#10.6"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*", "versionEndExcluding": "10.6"}]}]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-09T01:53:46.966005Z", "id": "CVE-2026-106587", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-09T01:54:07.453Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-106587", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-09T01:53:46.966005Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-09T01:54:03.229Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.6, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "OpenBSD", "product": "OpenSSH", "versions": [{"status": "affected", "version": "0", "lessThan": "10.6", "versionType": "custom"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.openssh.org/releasenotes.html#10.6"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "descriptions": [{"lang": "en", "value": "In sshd in OpenSSH before 10.6, the value \"none\" for a configuration option is sometimes interpreted as a filename but was intended to mean that a feature is disabled."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-843", "description": "CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "10.6"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-10-06T21:01:44.808Z"}}}, "cveMetadata": {"cveId": "CVE-2026-106587", "state": "PUBLISHED", "dateUpdated": "2026-10-09T01:54:07.453Z", "dateReserved": "2026-10-06T21:01:44.466Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-10-06T21:01:44.808Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "OpenSSH", "vendor": "OpenBSD", "versions": [{"lessThan": "10.6", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "cve@mitre.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*", "matchCriteriaId": "09209468-5A53-45C0-8698-8C668E53EBEA", "versionEndExcluding": "10.6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In sshd in OpenSSH before 10.6, the value \"none\" for a configuration option is sometimes interpreted as a filename but was intended to mean that a feature is disabled."}], "id": "CVE-2026-106587", "lastModified": "2026-10-09T16:39:23.107", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.6, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 2.5, "source": "cve@mitre.org", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-106587", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-09T01:53:46.966005Z", "version": "2.0.3"}}]}, "published": "2026-10-06T22:17:06.620", "references": [{"source": "cve@mitre.org", "tags": ["Release Notes"], "url": "https://www.openssh.org/releasenotes.html#10.6"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-843"}], "source": "cve@mitre.org", "type": "Secondary"}]}

{"bugzilla": {"description": "openssh: OpenSSH: Improper access control via misinterpretation of disabled configuration options", "id": "2547207", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2547207"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.6", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L", "status": "draft"}, "cwe": "CWE-115", "details": ["In sshd in OpenSSH before 10.6, the value \"none\" for a configuration option is sometimes interpreted as a filename but was intended to mean that a feature is disabled.", "A flaw was found in OpenSSH. When certain configuration options are set to \"none\" within a conditional block to disable a feature, the OpenSSH server daemon (sshd) incorrectly interprets the value as a literal file path rather than disabling the setting. A local attacker could exploit this issue by creating or manipulating a file named \"none\", potentially leading to improper access control enforcement or service disruption."], "mitigation": {"lang": "en:us", "value": "As a workaround, avoid setting options that accept the value \"none\" (for example AuthorizedPrincipalsFile) inside sshd_config Match blocks, where sshd misinterprets the value as a literal file path. Instead, apply the \"none\" value at the global configuration level outside of Match blocks, where it correctly disables the feature, or restructure the configuration so that these options are not set to \"none\" via a Match keyword. This prevents sshd from reading a file named \"none\" that may be controlled by a local user. Alternatively, updating to a version of OpenSSH that includes the upstream fix resolves the issue."}, "name": "CVE-2026-106587", "package_state": [{"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "openssh", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-10-06T21:01:44Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-106587\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-106587\nhttps://www.openssh.org/releasenotes.html#10.6"], "statement": "A low severity flaw was found in OpenSSH, affecting the openssh component shipped in Red Hat Hardened Images. Some sshd configuration options, including AuthorizedPrincipalsFile, are documented as accepting the value \"none\" to disable the corresponding feature. However, when such an option is overridden by a Match keyword in sshd_config(5), sshd incorrectly interprets \"none\" as a literal file path rather than disabling the feature. A local attacker with an unprivileged account on an affected system could exploit this by creating or manipulating a file named \"none\", potentially leading to improper access control enforcement or disruption of authentication or the sshd service. Exploitation requires a non-default configuration in which the affected options are set to \"none\" inside a conditional Match block. Red Hat rates this flaw as Low severity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L), consistent with the upstream NIST rating of Low (3.3). A fix for the affected Red Hat Hardened Images stream is being pursued through the delegated resolution process.", "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,10.6)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "OpenSSH", "source": "cna", "vendor": "OpenBSD"}, "product": "openssh", "vendor": "openbsd"}], "created": "2026-10-07T01:15:09.124124+00:00", "updated": "2026-10-20T08:30:12.200400+00:00", "vendors": ["openbsd", "openbsd$PRODUCT$openssh"]}