{"id":"CVE-2026-35385","title":"In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O (legacy scp protocol) and without -p (preserve mode).","summary":"In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O (legacy scp protocol) and without -p (preserve mode).","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":["CWE-281"],"vendor":"openbsd","product":"openssh","affected":["openssh < 10.3"],"patched":["openssh 10.3"],"published":"2026-04-02","updated":"2026-07-02","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-35385","references":[{"url":"https://marc.info/?l=openssh-unix-dev&m=177513443901484&w=2","label":"cve@mitre.org"},{"url":"https://www.openssh.org/releasenotes.html#10.3p1","label":"cve@mitre.org"},{"url":"https://www.openwall.com/lists/oss-security/2026/04/02/3","label":"cve@mitre.org"},{"url":"https://access.redhat.com/errata/RHSA-2026:12389","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:13380","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:13381","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:13383","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:14937","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:16059","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:19069","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:19219","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:20040","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:21275","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:21298","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:21398","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:22329","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:22468","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:22564","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:22648","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:25044","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:25063","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:25096","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:25181","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:26528","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:26542","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:28887","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:30078","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:30087","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:30088","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:30089","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/security/cve/CVE-2026-35385","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2454469","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-35385.json","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-35385"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35385"},{"url":"https://access.redhat.com/errata/RHSA-2026:28962"},{"url":"https://access.redhat.com/errata/RHSA-2026:34098"}],"tags":["nvd","csaf","vex","red-hat"],"epss":0.00563,"epssPercentile":0.46626,"ingestedAt":"2026-07-02T12:34:40.452Z","slug":"CVE-2026-35385","body":"## Overview\n\nIn OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O (legacy scp protocol) and without -p (preserve mode).\n\n## Affected\n\n- `openssh < 10.3`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `openssh 10.3`\n\n## Vendor advisories\n\n- **RHSA-2026:25063** · Red Hat · fixed in: Red Hat Enterprise Linux Server -EXTENSION(v. 6 ELS-EXTENSION) · released 2026-06-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:25063)\n- **RHSA-2026:22468** · Red Hat · fixed in: Red Hat Enterprise Linux Server (v. 7 ELS) · released 2026-06-02 · [advisory](https://access.redhat.com/errata/RHSA-2026:22468)\n- **RHSA-2026:26528** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.12 · released 2026-06-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:26528)\n- **RHSA-2026:26542** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.13 · released 2026-06-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:26542)\n- **RHSA-2026:28887** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.14 · released 2026-07-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:28887)\n- **RHSA-2026:28962** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.15 · released 2026-07-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:28962)\n- **RHSA-2026:25044** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.16 · released 2026-06-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:25044)\n- **RHSA-2026:34098** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.17 · released 2026-07-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:34098)\n- **RHSA-2026:25181** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.18 · released 2026-06-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:25181)\n- **RHSA-2026:20040** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.19 · released 2026-05-27 · [advisory](https://access.redhat.com/errata/RHSA-2026:20040)\n- **RHSA-2026:12389** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0) · released 2026-04-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:12389)\n- **Red Hat VEX** · Important · affected: Multicluster Engine for Kubernetes, Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat OpenShift Container Platform 4, OpenShift Pipelines · no fix planned: Multicluster Engine for Kubernetes, Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat OpenShift Container Platform 4 · updated 2026-10-02 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-35385.json)","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}