CVE-2026-35386Low· 3.6▾ SunlitIn OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line. This requires a scenario where the username on the command line is untrusted, and also requires a non-default configuration…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 19.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 1.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.3%
0.3% → 0.4%
In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line. This requires a scenario where the username on the command line is untrusted, and also requires a non-default configurations of % in ssh_config.
openssh >= 10.0, < 10.3Upgrade past the affected range:
openssh 10.3Connected by shared product, vendor, weakness, or advisory.
CVE-2026-35385High· 7.5In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O (legacy scp protocol) and without -p (preserve mode).
CVE-2026-110925Medium· 5.4A flaw was found in OpenSSH
CVE-2026-106583Low· 2.5In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection.
CVE-2026-55655Medium· 5.0A flaw was found in OpenSSH
CVE-2026-55654Low· 3.7A flaw was found in OpenSSH
CVE-2026-55653Medium· 4.3A flaw was found in OpenSSH