--- id: CVE-2026-35386 title: >- In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line summary: >- In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line. This requires a scenario where the username on the command line is untrusted, and also requires a non-default configuration… severity: low cvss: 3.6 cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N' cwe: - CWE-696 - CWE-78 vendor: openbsd product: openssh affected: - 'openssh >= 10.0, < 10.3' patched: - openssh 10.3 published: '2026-04-02' updated: '2026-07-07' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-35386' references: - url: 'https://marc.info/?l=openssh-unix-dev&m=177513443901484&w=2' label: cve@mitre.org - url: 'https://www.openssh.org/releasenotes.html#10.3p1' label: cve@mitre.org - url: 'https://www.openwall.com/lists/oss-security/2026/04/02/3' label: cve@mitre.org - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-35386.json - url: 'https://access.redhat.com/security/cve/CVE-2026-35386' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2454506' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-35386' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-35386' - url: 'https://access.redhat.com/errata/RHSA-2026:12389' - url: 'https://access.redhat.com/errata/RHSA-2026:13380' - url: 'https://access.redhat.com/errata/RHSA-2026:19069' - url: 'https://access.redhat.com/errata/RHSA-2026:13383' - url: 'https://access.redhat.com/errata/RHSA-2026:21398' - url: 'https://access.redhat.com/errata/RHSA-2026:22648' - url: 'https://access.redhat.com/errata/RHSA-2026:22564' - url: 'https://access.redhat.com/errata/RHSA-2026:16059' - url: 'https://access.redhat.com/errata/RHSA-2026:13381' - url: 'https://access.redhat.com/errata/RHSA-2026:19219' - url: 'https://access.redhat.com/errata/RHSA-2026:22329' - url: 'https://access.redhat.com/errata/RHSA-2026:21298' - url: 'https://access.redhat.com/errata/RHSA-2026:25096' - url: 'https://access.redhat.com/errata/RHSA-2026:14937' - url: 'https://access.redhat.com/errata/RHSA-2026:74674' - url: 'https://access.redhat.com/errata/RHSA-2026:21275' - url: 'https://access.redhat.com/errata/RHSA-2026:58981' tags: - nvd - csaf - vex - red-hat epss: 0.00319 epssPercentile: 0.24661 ingestedAt: '2026-07-07T16:15:38.005Z' --- ## Overview In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line. This requires a scenario where the username on the command line is untrusted, and also requires a non-default configurations of % in ssh_config. ## Affected - `openssh >= 10.0, < 10.3` ## Remediation Upgrade past the affected range: - `openssh 10.3` ## Vendor advisories - **RHSA-2026:12389** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0) · released 2026-04-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:12389) - **RHSA-2026:13380** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10) · released 2026-05-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:13380) - **RHSA-2026:19069** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10) · released 2026-05-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:19069) - **RHSA-2026:13383** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux BaseOS (v. 8) · released 2026-05-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:13383) - **RHSA-2026:21398** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream E4S (v.8.6), Red Hat Enterprise Linux AppStream TUS (v.8.6), Red Hat Enterprise Linux BaseOS AUS (v.8.6), Red Hat Enterprise Linux BaseOS E4S (v.8.6), Red Hat Enterprise Linux BaseOS TUS (v.8.6) · released 2026-05-27 · [advisory](https://access.redhat.com/errata/RHSA-2026:21398) - **RHSA-2026:22648** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.2), Red Hat Enterprise Linux BaseOS E4S (v.9.2) · released 2026-06-02 · [advisory](https://access.redhat.com/errata/RHSA-2026:22648) - **RHSA-2026:22564** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.4), Red Hat Enterprise Linux BaseOS EUS (v.9.4) · released 2026-06-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:22564) - **RHSA-2026:16059** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6) · released 2026-05-11 · [advisory](https://access.redhat.com/errata/RHSA-2026:16059) - **RHSA-2026:13381** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9) · released 2026-05-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:13381) - **RHSA-2026:19219** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9) · released 2026-05-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:19219) - **RHSA-2026:22329** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS AUS (v.8.4), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) · released 2026-06-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:22329) - **Red Hat VEX** · Low · affected: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat OpenShift Container Platform 4 · updated 2026-10-02 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-35386.json)