In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line. This requires a scenario where the username on the command line is untrusted, and also requires a non-default configurations of % in ssh_config.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade openssh-clientsUpgrade openssh-cavsUpgrade openssh-askpassUpgrade pam_ssh_agent_authUpgrade opensshUpgrade openssh-keycatUpgrade openssh-ldapUpgrade openssh-server | May 5, 2026 | May 4, 2026 |
| Amazon_linux_2023 | — | Upgrade openssh-server-debuginfoUpgrade opensshUpgrade openssh-debuginfoUpgrade openssh-keycat-debuginfoUpgrade openssh-clients-debuginfoUpgrade pam_ssh_agent_authUpgrade openssh-clientsUpgrade pam_ssh_agent_auth-debuginfoUpgrade openssh-serverUpgrade openssh-keycatUpgrade openssh-debugsource | May 28, 2026 | Apr 2, 2026 |
| Debian | — | Upgrade openssh | May 17, 2026 | May 17, 2026 |
| Ibm Aix | — | Apply the fix or workaround for openssh_advisory21 | May 31, 2026 | May 28, 2026 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jul 2, 2026 | Jul 1, 2026 |
| Openbsd Openssh | — | Upgrade to OpenSSH version 10.3 | Apr 28, 2026 | Apr 2, 2026 |
| Oracle_linux | — | Upgrade openssh-ldapUpgrade pam_ssh_agent_authUpgrade opensshUpgrade openssh-askpassUpgrade openssh-keysignUpgrade openssh-cavsUpgrade openssh-clientsUpgrade openssh-keycatUpgrade openssh-server | May 6, 2026 | Apr 2, 2026 |
| Redhat_linux | — | Upgrade openssh-keycat-debuginfoUpgrade openssh-keycatUpgrade pam_ssh_agent_authUpgrade openssh-clients-debuginfoUpgrade openssh-ldapUpgrade openssh-server-debuginfoNo solution existsUpgrade openssh-clientsUpgrade openssh-askpassUpgrade openssh-keysignUpgrade openssh-askpass-debuginfoUpgrade pam_ssh_agent_auth-debuginfoUpgrade openssh-keysign-debuginfoUpgrade openssh-cavsUpgrade openssh-serverUpgrade openssh-debuginfoUpgrade openssh-cavs-debuginfoUpgrade opensshUpgrade openssh-sk-dummy-debuginfoUpgrade openssh-ldap-debuginfoUpgrade openssh-debugsource | May 4, 2026 | Apr 2, 2026 |
| Rocky_linux | — | Upgrade openssh-keysignUpgrade openssh-keycatUpgrade openssh-askpassUpgrade opensshUpgrade openssh-clientsUpgrade pam_ssh_agent_authUpgrade openssh-clients-debuginfoUpgrade openssh-keysign-debuginfoUpgrade openssh-ldap-debuginfoUpgrade pam_ssh_agent_auth-debuginfoUpgrade openssh-askpass-debuginfoUpgrade openssh-cavs-debuginfoUpgrade openssh-cavsUpgrade openssh-keycat-debuginfoUpgrade openssh-debugsourceUpgrade openssh-debuginfoUpgrade openssh-serverUpgrade openssh-ldapUpgrade openssh-server-debuginfo | May 11, 2026 | May 6, 2026 |
| Ubuntu | — | Upgrade openssh-client (Ubuntu Pro)Upgrade openssh-server (Ubuntu Pro)Upgrade openssh-serverUpgrade openssh-client | Apr 29, 2026 | Apr 2, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Apr 2, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub