Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.1
CVE-2026-35386: OpenSSH: Malicious username can execute commands on remote server
CVE-2026-35386 · published 7 months ago
Summary
If you use OpenSSH to connect to a server, a hacker could potentially trick the system into running malicious commands if they can control the username used for the connection. This requires specific misconfigurations on the server. To protect yourself, ensure you have the latest version of OpenSSH installed, and review your configuration settings to ensure they are secure.
What to do
- Update bellsoft openssh to version 10.3_p1-r0.
- Update canonical openssh to version 1:8.9p1-3ubuntu0.15.
- Update canonical openssh to version 1:9.6p1-3ubuntu13.16.
- Update canonical openssh to version 1:10.0p1-5ubuntu5.4.
- Update canonical openssh to version 1:10.2p1-2ubuntu3.2.
- Update debian rootio-openssh to version 1:9.2p1-2+deb12u9.root.io.10.
- Update debian openssh to version 1:8.4p1-5+deb11u7.
- Update debian openssh to version 1:9.2p1-2+deb12u10.
- Update debian openssh to version 1:10.0p1-7+deb13u3.
- Update debian openssh to version 1:10.3p1-1.
- Update canonical openssh to version 1:8.9p1-3ubuntu0.15+Fips1.
- Update canonical openssh to version 1:9.6p1-3ubuntu13.16+Fips1.
- Update canonical openssh to version 1:6.6p1-2ubuntu2.13+esm4.
- Update openbsd openssh to version 10.3 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:11 | debian | openssh |
< 1:8.4p1-5+deb11u7 Fix: upgrade to 1:8.4p1-5+deb11u7
|
| Debian:12 | debian | openssh |
< 1:9.2p1-2+deb12u10 Fix: upgrade to 1:9.2p1-2+deb12u10
|
| Debian:13 | debian | openssh |
< 1:10.0p1-7+deb13u3 Fix: upgrade to 1:10.0p1-7+deb13u3
|
| Debian:14 | debian | openssh |
< 1:10.3p1-1 Fix: upgrade to 1:10.3p1-1
|
| BellSoft Hardened Containers:stream | bellsoft | openssh |
>= 9.3_p1-r7, < 10.3_p1-r0 Fix: upgrade to 10.3_p1-r0
|
| Alpaquita:25 | bellsoft | openssh |
>= 10.0_p1-r7, < 10.3_p1-r0 Fix: upgrade to 10.3_p1-r0
|
| Alpaquita:stream | bellsoft | openssh |
>= 9.3_p1-r7, < 10.3_p1-r0 Fix: upgrade to 10.3_p1-r0
|
| – | openbsd | openssh |
< 10.3 >= 10.0, < 10.3 cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:* |
| Ubuntu:Pro:14.04:LTS | canonical | openssh |
< 1:6.6p1-2ubuntu2.13+esm4 Fix: upgrade to 1:6.6p1-2ubuntu2.13+esm4
|
| Ubuntu:Pro:16.04:LTS | canonical | openssh | All versions |
| Ubuntu:Pro:FIPS:16.04:LTS | canonical | openssh | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | openssh | All versions |
| Ubuntu:18.04:LTS | canonical | openssh-ssh1 | All versions |
| Ubuntu:Pro:FIPS-updates:18.04:LTS | canonical | openssh | All versions |
| Ubuntu:Pro:FIPS:18.04:LTS | canonical | openssh | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | openssh | All versions |
| Ubuntu:20.04:LTS | canonical | openssh-ssh1 | All versions |
| Ubuntu:Pro:FIPS-updates:20.04:LTS | canonical | openssh | All versions |
| Ubuntu:Pro:FIPS:20.04:LTS | canonical | openssh | All versions |
| Ubuntu:22.04:LTS | canonical | openssh |
< 1:8.9p1-3ubuntu0.15 Fix: upgrade to 1:8.9p1-3ubuntu0.15
|
| Ubuntu:22.04:LTS | canonical | openssh-ssh1 | All versions |
| Ubuntu:Pro:FIPS-preview:22.04:LTS | canonical | openssh | All versions |
| Ubuntu:Pro:FIPS-updates:22.04:LTS | canonical | openssh |
< 1:8.9p1-3ubuntu0.15+Fips1 Fix: upgrade to 1:8.9p1-3ubuntu0.15+Fips1
|
| Ubuntu:24.04:LTS | canonical | openssh |
< 1:9.6p1-3ubuntu13.16 Fix: upgrade to 1:9.6p1-3ubuntu13.16
|
| Ubuntu:24.04:LTS | canonical | openssh-ssh1 | All versions |
| Ubuntu:Pro:FIPS-updates:24.04:LTS | canonical | openssh |
< 1:9.6p1-3ubuntu13.16+Fips1 Fix: upgrade to 1:9.6p1-3ubuntu13.16+Fips1
|
| Ubuntu:25.10 | canonical | openssh |
< 1:10.0p1-5ubuntu5.4 Fix: upgrade to 1:10.0p1-5ubuntu5.4
|
| Ubuntu:25.10 | canonical | openssh-ssh1 | All versions |
| Ubuntu:26.04 | canonical | openssh |
< 1:10.2p1-2ubuntu3.2 Fix: upgrade to 1:10.2p1-2ubuntu3.2
|
| Ubuntu:26.04 | canonical | openssh-ssh1 | All versions |
| Root:Debian:12 | debian | rootio-openssh |
< 1:9.2p1-2+deb12u9.root.io.10 Fix: upgrade to 1:9.2p1-2+deb12u9.root.io.10
|
| BellSoft Hardened Containers:25 | bellsoft | openssh |
>= 10.0_p1-r7, < 10.3_p1-r0 Fix: upgrade to 10.3_p1-r0
|
Original advisory text
In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line. This requires a scenario where the username on the command line is untrusted, and a...
In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line. This requires a scenario where the username on the command line is untrusted, and also requires a non-default configurations of % in ssh_config.
References
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35386... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-35386 Vendor Advisory
- https://marc.info/?l=openssh-unix-dev&m=177513443901484&w=2 URL
- https://www.openssh.org/releasenotes.html#10.3p1 Third Party Advisory
- https://ubuntu.com/security/CVE-2026-35386 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-35386 Third Party Advisory
- https://ubuntu.com/security/notices/USN-8222-1 Vendor Advisory
- https://security-tracker.debian.org/tracker/CVE-2026-35386 Vendor Advisory
- https://docs.bell-sw.com/security/cves/CVE-2026-35386 Vendor Advisory
- https://www.openwall.com/lists/oss-security/2026/04/02/3 URL
- https://ubuntu.com/security/notices/USN-8804-1 Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-696Incorrect Behavior Order
Timeline
Published2 Apr 2026
Updated4 Nov 2026
First seen2 Apr 2026
Sources
BELL-CVE-2026-35386 · OSV
CVE-2026-35386 · NVD
DEBIAN-CVE-2026-35386 · OSV
UBUNTU-CVE-2026-35386 · OSV
CVE-2026-35386 · OSV
Track software like this
Free during beta