In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line. This requires a scenario where the username on the command line is untrusted, and also requires a non-default configurations of % in ssh_config.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade openssh-askpassUpgrade openssh-ldapUpgrade openssh-cavsUpgrade openssh-clientsUpgrade openssh-keycatUpgrade opensshUpgrade pam_ssh_agent_authUpgrade openssh-server | May 5, 2026 | May 4, 2026 |
| Amazon_linux_2023 | — | Upgrade openssh-keycat-debuginfoUpgrade opensshUpgrade openssh-server-debuginfoUpgrade openssh-debuginfoUpgrade pam_ssh_agent_authUpgrade openssh-clients-debuginfoUpgrade openssh-keycatUpgrade openssh-clientsUpgrade openssh-serverUpgrade pam_ssh_agent_auth-debuginfoUpgrade openssh-debugsource | May 28, 2026 | Apr 2, 2026 |
| Debian | — | Upgrade openssh | May 17, 2026 | May 17, 2026 |
| Ibm Aix | — | Apply the fix or workaround for openssh_advisory21 | May 31, 2026 | May 28, 2026 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jul 2, 2026 | Jul 1, 2026 |
| Openbsd Openssh | — | Upgrade to OpenSSH version 10.3 | Apr 28, 2026 | Apr 2, 2026 |
| Oracle_linux | — | Upgrade openssh-askpassUpgrade openssh-serverUpgrade openssh-keycatUpgrade opensshUpgrade openssh-cavsUpgrade openssh-clientsUpgrade openssh-keysignUpgrade openssh-ldapUpgrade pam_ssh_agent_auth | May 6, 2026 | Apr 2, 2026 |
| Redhat_linux | — | Upgrade pam_ssh_agent_authNo solution existsUpgrade openssh-ldapUpgrade openssh-server-debuginfoUpgrade openssh-keycat-debuginfoUpgrade openssh-clients-debuginfoUpgrade openssh-keycatUpgrade openssh-clientsUpgrade openssh-sk-dummy-debuginfoUpgrade openssh-debugsourceUpgrade openssh-keysignUpgrade openssh-debuginfoUpgrade openssh-cavs-debuginfoUpgrade openssh-askpassUpgrade openssh-ldap-debuginfoUpgrade openssh-askpass-debuginfoUpgrade pam_ssh_agent_auth-debuginfoUpgrade openssh-keysign-debuginfoUpgrade openssh-cavsUpgrade opensshUpgrade openssh-server | May 4, 2026 | Apr 2, 2026 |
| Rocky_linux | — | Upgrade openssh-askpassUpgrade openssh-clientsUpgrade openssh-keysignUpgrade pam_ssh_agent_authUpgrade opensshUpgrade openssh-clients-debuginfoUpgrade openssh-keycatUpgrade openssh-debugsourceUpgrade openssh-serverUpgrade openssh-cavsUpgrade openssh-askpass-debuginfoUpgrade openssh-ldapUpgrade openssh-ldap-debuginfoUpgrade pam_ssh_agent_auth-debuginfoUpgrade openssh-keysign-debuginfoUpgrade openssh-server-debuginfoUpgrade openssh-cavs-debuginfoUpgrade openssh-debuginfoUpgrade openssh-keycat-debuginfo | May 11, 2026 | May 6, 2026 |
| Ubuntu | — | Upgrade openssh-serverUpgrade openssh-client | Apr 29, 2026 | Apr 2, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Apr 2, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub