Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
OpenSSH could let attackers write files or steal data
published 16 days ago
Summary
The OpenSSH client and server software, including its GSSAPI component, have several flaws that could let a malicious server write files to wrong locations, expose credentials, inject commands, alter certificate dates, or cause a crash. These issues could lead to unauthorized data access or service disruption. Apply the latest security updates from the vendor as soon as possible to protect your systems.
What to do
- Update canonical openssh to version 1:10.5p1-1ubuntu3.1.
- Update canonical openssh-gssapi to version 1:10.5p1-1ubuntu3.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:26.10 | canonical | openssh |
< 1:10.5p1-1ubuntu3.1 Fix: upgrade to 1:10.5p1-1ubuntu3.1
|
| Ubuntu:26.10 | canonical | openssh-gssapi |
< 1:10.5p1-1ubuntu3.1 Fix: upgrade to 1:10.5p1-1ubuntu3.1
|
Original advisory text
openssh, openssh-gssapi vulnerabilities
It was discovered that OpenSSH's sftp client incorrectly handled paths
returned by the server during a recursive copy operation. A remote attacker
controlling the server could possibly use this issue to write files to
unintended locations. (CVE-2026-106552)
It was discovered that OpenSSH's sshd server incorrectly handled
GSSAPIAuthentication state across authentication attempts. An attacker
could possibly use this issue to obtain credentials from a previous failed
authentication attempt. (CVE-2026-106553, CVE-2026-106555)
It was discovered that OpenSSH incorrectly used an LZ77 dictionary coder
during compression. An attacker could possibly use this issue to obtain
sensitive information. (CVE-2026-106582)
It was discovered that OpenSSH's ssh client incorrectly allowed special
characters in command-line usernames. An attacker could possibly use this
issue to inject arbitrary commands via specially crafted usernames.
(CVE-2026-106583)
It was discovered that OpenSSH's ssh-keygen incorrectly handled Daylight
Saving Time when converting dates. An attacker could possibly use this
issue to cause certificates to have incorrect expiration times.
(CVE-2026-106584)
It was discovered that OpenSSH did not check whether the maximum packet
length was exceeded during decompression. A remote attacker could possibly
use this issue to cause a denial of service. (CVE-2026-106585)
It was discovered that OpenSSH's sshd server incorrectly applied the
restrict keyword from authorized_keys to tunnel forwarding requests. A
local attacker with an authorized key could possibly use this issue to
bypass intended tunnel forwarding restrictions. (CVE-2026-106586)
It was discovered that OpenSSH's sshd server incorrectly handled certain
configuration options that accept a "none" value. An attacker could
possibly use this issue to cause OpenSSH to behave unexpectedly.
(CVE-2026-106587)
returned by the server during a recursive copy operation. A remote attacker
controlling the server could possibly use this issue to write files to
unintended locations. (CVE-2026-106552)
It was discovered that OpenSSH's sshd server incorrectly handled
GSSAPIAuthentication state across authentication attempts. An attacker
could possibly use this issue to obtain credentials from a previous failed
authentication attempt. (CVE-2026-106553, CVE-2026-106555)
It was discovered that OpenSSH incorrectly used an LZ77 dictionary coder
during compression. An attacker could possibly use this issue to obtain
sensitive information. (CVE-2026-106582)
It was discovered that OpenSSH's ssh client incorrectly allowed special
characters in command-line usernames. An attacker could possibly use this
issue to inject arbitrary commands via specially crafted usernames.
(CVE-2026-106583)
It was discovered that OpenSSH's ssh-keygen incorrectly handled Daylight
Saving Time when converting dates. An attacker could possibly use this
issue to cause certificates to have incorrect expiration times.
(CVE-2026-106584)
It was discovered that OpenSSH did not check whether the maximum packet
length was exceeded during decompression. A remote attacker could possibly
use this issue to cause a denial of service. (CVE-2026-106585)
It was discovered that OpenSSH's sshd server incorrectly applied the
restrict keyword from authorized_keys to tunnel forwarding requests. A
local attacker with an authorized key could possibly use this issue to
bypass intended tunnel forwarding restrictions. (CVE-2026-106586)
It was discovered that OpenSSH's sshd server incorrectly handled certain
configuration options that accept a "none" value. An attacker could
possibly use this issue to cause OpenSSH to behave unexpectedly.
(CVE-2026-106587)
References
- https://ubuntu.com/security/notices/USN-8937-1 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-106552 Third Party Advisory
- https://ubuntu.com/security/CVE-2026-106553 Third Party Advisory
- https://ubuntu.com/security/CVE-2026-106555 Third Party Advisory
- https://ubuntu.com/security/CVE-2026-106582 Third Party Advisory
- https://ubuntu.com/security/CVE-2026-106583 Third Party Advisory
- https://ubuntu.com/security/CVE-2026-106584 Third Party Advisory
- https://ubuntu.com/security/CVE-2026-106585 Third Party Advisory
- https://ubuntu.com/security/CVE-2026-106586 Third Party Advisory
- https://ubuntu.com/security/CVE-2026-106587 Third Party Advisory
Timeline
Published19 Oct 2026
Updated20 Oct 2026
First seen20 Oct 2026
Sources
USN-8937-1 · OSV
Track software like this
Free during beta