CVE-2026-56624

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-56624", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-06-22T15:05:27.038Z", "datePublished": "2026-07-20T20:28:26.333Z", "dateUpdated": "2026-07-23T03:56:23.660Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "org.apache.sshd:sshd-core", "product": "Apache MINA SSHD", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "2.18.0", "status": "affected", "version": "2.0.0", "versionType": "maven"}, {"lessThanOrEqual": "3.0.0-M4", "status": "affected", "version": "3.0.0-M1", "versionType": "maven"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Mitchell Benjamin"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<div>Improper certificate validation in Apache MINA SSHD (server-side).&nbsp;Apache MINA SSHD is a Java library for client-side and server-side SSH.</div><div><br></div><div>Server-side OpenSSH user certificate validation during user authentication in an Apache MINA SSHD server did not check for the unsupported force-command or verify-required options that could be embedded in the certificate, nor did it validate these options. As a result it was possible that a user could authenticate with such a certificate that included a force-command option but still was able to execute other commands. What other command exactly would be available to the user depends on the implementation of the server.</div><div><br></div><div>This issue is fixed in Apache MINA SSHD 2.19.0 and 3.0.0-M5. Applications are advised to upgrade to these versions.</div><div><br></div><div>The fix rejects OpenSSH user certificates that include these options, since Apache MINA SSHD implements neither force-command nor sk-*-cert-v01@openssh.com user certificates (which are the only ones for which verify-required would make sense).</div>"}], "value": "Improper certificate validation in Apache MINA SSHD (server-side).\u00a0Apache MINA SSHD is a Java library for client-side and server-side SSH.\n\n\n\n\nServer-side OpenSSH user certificate validation during user authentication in an Apache MINA SSHD server did not check for the unsupported force-command or verify-required options that could be embedded in the certificate, nor did it validate these options. As a result it was possible that a user could authenticate with such a certificate that included a force-command option but still was able to execute other commands. What other command exactly would be available to the user depends on the implementation of the server.\n\n\n\n\nThis issue is fixed in Apache MINA SSHD 2.19.0 and 3.0.0-M5. Applications are advised to upgrade to these versions.\n\n\n\n\nThe fix rejects OpenSSH user certificates that include these options, since Apache MINA SSHD implements neither force-command nor sk-*-cert-v01@openssh.com user certificates (which are the only ones for which verify-required would make sense)."}], "metrics": [{"other": {"content": {"text": "moderate"}, "type": "Textual description of severity"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-295", "description": "CWE-295 Improper Certificate Validation", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-07-20T20:28:26.333Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://lists.apache.org/thread/o4c2jml522j3z80gbryqzc2f1253ltp6"}], "source": {"discovery": "EXTERNAL"}, "title": "Apache MINA SSHD: SSH certificate options lack validations", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/07/20/17"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-07-20T22:20:01.873Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-22T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-56624"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-23T03:56:23.660Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/07/20/17"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-07-20T22:20:01.873Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-56624", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-21T17:07:22.689781Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-21T17:07:27.486Z"}}], "cna": {"title": "Apache MINA SSHD: SSH certificate options lack validations", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Mitchell Benjamin"}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "moderate"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache MINA SSHD", "versions": [{"status": "affected", "version": "2.0.0", "versionType": "maven", "lessThanOrEqual": "2.18.0"}, {"status": "affected", "version": "3.0.0-M1", "versionType": "maven", "lessThanOrEqual": "3.0.0-M4"}], "packageName": "org.apache.sshd:sshd-core", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}], "references": [{"url": "https://lists.apache.org/thread/o4c2jml522j3z80gbryqzc2f1253ltp6", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Improper certificate validation in Apache MINA SSHD (server-side).\u00a0Apache MINA SSHD is a Java library for client-side and server-side SSH.\n\n\n\n\nServer-side OpenSSH user certificate validation during user authentication in an Apache MINA SSHD server did not check for the unsupported force-command or verify-required options that could be embedded in the certificate, nor did it validate these options. As a result it was possible that a user could authenticate with such a certificate that included a force-command option but still was able to execute other commands. What other command exactly would be available to the user depends on the implementation of the server.\n\n\n\n\nThis issue is fixed in Apache MINA SSHD 2.19.0 and 3.0.0-M5. Applications are advised to upgrade to these versions.\n\n\n\n\nThe fix rejects OpenSSH user certificates that include these options, since Apache MINA SSHD implements neither force-command nor sk-*-cert-v01@openssh.com user certificates (which are the only ones for which verify-required would make sense).", "supportingMedia": [{"type": "text/html", "value": "<div>Improper certificate validation in Apache MINA SSHD (server-side).&nbsp;Apache MINA SSHD is a Java library for client-side and server-side SSH.</div><div><br></div><div>Server-side OpenSSH user certificate validation during user authentication in an Apache MINA SSHD server did not check for the unsupported force-command or verify-required options that could be embedded in the certificate, nor did it validate these options. As a result it was possible that a user could authenticate with such a certificate that included a force-command option but still was able to execute other commands. What other command exactly would be available to the user depends on the implementation of the server.</div><div><br></div><div>This issue is fixed in Apache MINA SSHD 2.19.0 and 3.0.0-M5. Applications are advised to upgrade to these versions.</div><div><br></div><div>The fix rejects OpenSSH user certificates that include these options, since Apache MINA SSHD implements neither force-command nor sk-*-cert-v01@openssh.com user certificates (which are the only ones for which verify-required would make sense).</div>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-295", "description": "CWE-295 Improper Certificate Validation"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-07-20T20:28:26.333Z"}}}, "cveMetadata": {"cveId": "CVE-2026-56624", "state": "PUBLISHED", "dateUpdated": "2026-07-23T03:56:23.660Z", "dateReserved": "2026-06-22T15:05:27.038Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2026-07-20T20:28:26.333Z", "assignerShortName": "apache"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "org.apache.sshd:sshd-core", "product": "Apache MINA SSHD", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "2.18.0", "status": "affected", "version": "2.0.0", "versionType": "maven"}, {"lessThanOrEqual": "3.0.0-M4", "status": "affected", "version": "3.0.0-M1", "versionType": "maven"}]}], "source": "security@apache.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:mina_sshd:*:*:*:*:*:*:*:*", "matchCriteriaId": "93103A71-FB42-4C50-8529-232D40EAD7DD", "versionEndExcluding": "2.19.0", "versionStartIncluding": "2.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:mina_sshd:3.0.0:m1:*:*:*:*:*:*", "matchCriteriaId": "32435A6F-3BD6-4AAB-93B1-0B1514419A50", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:mina_sshd:3.0.0:m2:*:*:*:*:*:*", "matchCriteriaId": "0E399FD6-9A33-4F78-AFCE-F46C7BBC56F1", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:mina_sshd:3.0.0:m3:*:*:*:*:*:*", "matchCriteriaId": "13419EBE-E6B4-4895-BF6C-FC910076CC7A", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:mina_sshd:3.0.0:m4:*:*:*:*:*:*", "matchCriteriaId": "1B2D4A4D-BEF5-416F-91AD-B4F278B04C76", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper certificate validation in Apache MINA SSHD (server-side).\u00a0Apache MINA SSHD is a Java library for client-side and server-side SSH.\n\n\n\n\nServer-side OpenSSH user certificate validation during user authentication in an Apache MINA SSHD server did not check for the unsupported force-command or verify-required options that could be embedded in the certificate, nor did it validate these options. As a result it was possible that a user could authenticate with such a certificate that included a force-command option but still was able to execute other commands. What other command exactly would be available to the user depends on the implementation of the server.\n\n\n\n\nThis issue is fixed in Apache MINA SSHD 2.19.0 and 3.0.0-M5. Applications are advised to upgrade to these versions.\n\n\n\n\nThe fix rejects OpenSSH user certificates that include these options, since Apache MINA SSHD implements neither force-command nor sk-*-cert-v01@openssh.com user certificates (which are the only ones for which verify-required would make sense)."}, {"lang": "es", "value": "Validaci\u00f3n de certificado incorrecta en Apache MINA SSHD (lado del servidor). Apache MINA SSHD es una biblioteca Java para SSH del lado del cliente y del lado del servidor.\n\nLa validaci\u00f3n de certificados de usuario de OpenSSH del lado del servidor durante la autenticaci\u00f3n de usuario en un servidor Apache MINA SSHD no verific\u00f3 las opciones no compatibles force-command o verify-required que podr\u00edan estar incrustadas en el certificado, ni valid\u00f3 estas opciones. Como resultado, fue posible que un usuario pudiera autenticarse con un certificado que inclu\u00eda una opci\u00f3n force-command pero a\u00fan as\u00ed pudo ejecutar otros comandos. Qu\u00e9 otro comando exactamente estar\u00eda disponible para el usuario depende de la implementaci\u00f3n del servidor.\n\nEste problema est\u00e1 solucionado en Apache MINA SSHD 2.19.0 y 3.0.0-M5. Se aconseja a las aplicaciones actualizar a estas versiones.\n\nLa soluci\u00f3n rechaza los certificados de usuario de OpenSSH que incluyen estas opciones, ya que Apache MINA SSHD no implementa ni force-command ni los certificados de usuario sk-*-cert-v01@openssh.com (que son los \u00fanicos para los que verify-required tendr\u00eda sentido)."}], "id": "CVE-2026-56624", "lastModified": "2026-10-24T20:10:00.137", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 5.2, "source": "security@apache.org", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-56624", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-07-22T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-07-20T21:16:49.070", "references": [{"source": "security@apache.org", "tags": ["Vendor Advisory", "Mailing List"], "url": "https://lists.apache.org/thread/o4c2jml522j3z80gbryqzc2f1253ltp6"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2026/07/20/17"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-295"}], "source": "security@apache.org", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.0.0,2.18.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.0.0-M1,3.0.0-M4]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Apache MINA SSHD", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "mina_sshd", "vendor": "apache"}], "created": "2026-07-26T07:00:05.506101+00:00", "updated": "2026-07-30T18:30:05.023634+00:00", "vendors": ["apache", "apache$PRODUCT$mina_sshd"]}