Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
OpenSSH Security Update: Malicious Files and Unauthorized Access
published 5 months ago
Summary
An update is available for OpenSSH to prevent malicious files from being installed with elevated permissions and to ensure proper handling of user authorization. This update affects OpenSSH users, particularly those who use the scp command to transfer files. To stay secure, update your OpenSSH installation as soon as possible.
Original advisory text
Security update for openssh
This update for openssh fixes the following issues
- CVE-2026-35385: a file downloaded by scp may be installed setuid or setgid (bsc#1261427).
- CVE-2026-35414: mishandling of authorized_keys principals option (bsc#1261430).
- CVE-2026-35385: a file downloaded by scp may be installed setuid or setgid (bsc#1261427).
- CVE-2026-35414: mishandling of authorized_keys principals option (bsc#1261430).
References
- https://www.suse.com/support/update/announcement/2026/suse-su-20261876-1/ Vendor Advisory
- https://bugzilla.suse.com/1261427 Third Party Advisory
- https://bugzilla.suse.com/1261430 Third Party Advisory
- https://www.suse.com/security/cve/CVE-2026-35385 URL
- https://www.suse.com/security/cve/CVE-2026-35414 URL
Timeline
Published15 May 2026
Updated19 May 2026
First seen19 May 2026
Sources
SUSE-SU-2026:1876-1 · OSV
Track software like this
Free during beta