RadioCSIRT - WID-SEC-W-2026-3785 - Vulnerability-Lookup

WID-SEC-W-2026-3785

Vulnerability from csaf_certbund - Published: 2026-10-06 22:00 - Updated: 2026-10-22 22:00

Summary

OpenSSH: Mehrere Schwachstellen

Severity

Mittel

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: OpenSSH ist eine Open Source Implementierung des Secure Shell Protokolls.

Angriff: Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in OpenSSH ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um einen Denial of Service herbeizufürhen oder seine Rechte auszuweiten.

Betroffene Betriebssysteme: - Linux - MacOS X - UNIX - Windows

CVE-2026-106552

Affected products

Known affected 4 products

Product	Identifier	Version	Remediation
Open Source OpenSSH <10.6p1 Open Source / OpenSSH		<10.6p1
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Ubuntu Linux Ubuntu	`cpe:/o:canonical:ubuntu_linux:-`	—
Fedora Linux Fedora	`cpe:/o:fedoraproject:fedora:-`	—

Last affected 1 product

Product	Identifier	Version	Remediation
Open Source OpenSSH <=10.6 Open Source / OpenSSH		<=10.6

CVE-2026-106553

Affected products

Known affected 4 products, the same list as for CVE-2026-106552

Last affected 1 product, the same list as for CVE-2026-106552

CVE-2026-106555

Affected products

Known affected 4 products, the same list as for CVE-2026-106552

Last affected 1 product, the same list as for CVE-2026-106552

CVE-2026-106582

Affected products

Known affected 4 products, the same list as for CVE-2026-106552

Last affected 1 product, the same list as for CVE-2026-106552

CVE-2026-106583

Affected products

Known affected 4 products, the same list as for CVE-2026-106552

Last affected 1 product, the same list as for CVE-2026-106552

CVE-2026-106584

Affected products

Known affected 4 products, the same list as for CVE-2026-106552

Last affected 1 product, the same list as for CVE-2026-106552

CVE-2026-106585

Affected products

Known affected 4 products, the same list as for CVE-2026-106552

Last affected 1 product, the same list as for CVE-2026-106552

CVE-2026-106586

Affected products

Known affected 4 products, the same list as for CVE-2026-106552

Last affected 1 product, the same list as for CVE-2026-106552

CVE-2026-106587

Affected products

Known affected 4 products, the same list as for CVE-2026-106552

Last affected 1 product, the same list as for CVE-2026-106552

CVE-2026-106588

Affected products

Known affected 4 products, the same list as for CVE-2026-106552

Last affected 1 product, the same list as for CVE-2026-106552

CVE-2026-106589

Affected products

Known affected 4 products, the same list as for CVE-2026-106552

Last affected 1 product, the same list as for CVE-2026-106552

References

18 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://www.openssh.org/releasenotes.html#10.6	external
https://github.com/advisories/GHSA-8WPC-X9XG-9Q94	external
https://github.com/advisories/GHSA-74G8-X9G6-GWMC	external
https://github.com/advisories/GHSA-8FMQ-PFXF-6HMC	external
https://github.com/advisories/GHSA-JRJW-PC9R-C624	external
https://github.com/advisories/GHSA-J4H6-744F-Q3HQ	external
https://github.com/advisories/GHSA-9HQ3-HC6P-GC8Q	external
https://github.com/advisories/GHSA-9XXF-58MH-Q784	external
https://github.com/advisories/GHSA-J45V-7HGC-XV9X	external
https://github.com/advisories/GHSA-2XXV-M3RC-RVRM	external
https://github.com/advisories/GHSA-695P-3Q57-GFF4	external
https://github.com/advisories/GHSA-99HR-WQ4P-X49Q	external
https://ubuntu.com/security/notices/USN-8928-1	external
https://access.redhat.com/errata/RHSA-2026:84849	external
https://bodhi.fedoraproject.org/updates/FEDORA-20…	external
https://bodhi.fedoraproject.org/updates/FEDORA-20…	external

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "OpenSSH ist eine Open Source Implementierung des Secure Shell Protokolls.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in OpenSSH ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um einen Denial of Service herbeizuf\u00fcrhen oder seine Rechte auszuweiten.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- MacOS X\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-3785 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-3785.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-3785 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-3785"
      },
      {
        "category": "external",
        "summary": "OpenSSH Release Notes vom 2026-10-06",
        "url": "https://www.openssh.org/releasenotes.html#10.6"
      },
      {
        "category": "external",
        "summary": "GitHub Advisory Database vom 2026-10-06",
        "url": "https://github.com/advisories/GHSA-8WPC-X9XG-9Q94"
      },
      {
        "category": "external",
        "summary": "GitHub Advisory Database vom 2026-10-06",
        "url": "https://github.com/advisories/GHSA-74G8-X9G6-GWMC"
      },
      {
        "category": "external",
        "summary": "GitHub Advisory Database vom 2026-10-06",
        "url": "https://github.com/advisories/GHSA-8FMQ-PFXF-6HMC"
      },
      {
        "category": "external",
        "summary": "GitHub Advisory Database vom 2026-10-06",
        "url": "https://github.com/advisories/GHSA-JRJW-PC9R-C624"
      },
      {
        "category": "external",
        "summary": "GitHub Advisory Database vom 2026-10-06",
        "url": "https://github.com/advisories/GHSA-J4H6-744F-Q3HQ"
      },
      {
        "category": "external",
        "summary": "GitHub Advisory Database vom 2026-10-06",
        "url": "https://github.com/advisories/GHSA-9HQ3-HC6P-GC8Q"
      },
      {
        "category": "external",
        "summary": "GitHub Advisory Database vom 2026-10-06",
        "url": "https://github.com/advisories/GHSA-9XXF-58MH-Q784"
      },
      {
        "category": "external",
        "summary": "GitHub Advisory Database vom 2026-10-06",
        "url": "https://github.com/advisories/GHSA-J45V-7HGC-XV9X"
      },
      {
        "category": "external",
        "summary": "GitHub Advisory Database vom 2026-10-06",
        "url": "https://github.com/advisories/GHSA-2XXV-M3RC-RVRM"
      },
      {
        "category": "external",
        "summary": "GitHub Advisory Database vom 2026-10-06",
        "url": "https://github.com/advisories/GHSA-695P-3Q57-GFF4"
      },
      {
        "category": "external",
        "summary": "GitHub Advisory Database vom 2026-10-06",
        "url": "https://github.com/advisories/GHSA-99HR-WQ4P-X49Q"
      },
      {
        "category": "external",
        "summary": "Ubuntu Security Notice USN-8928-1 vom 2026-10-14",
        "url": "https://ubuntu.com/security/notices/USN-8928-1"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:84849 vom 2026-10-19",
        "url": "https://access.redhat.com/errata/RHSA-2026:84849"
      },
      {
        "category": "external",
        "summary": "Fedora Security Advisory FEDORA-2026-A2ED02274A vom 2026-10-22",
        "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-a2ed02274a"
      },
      {
        "category": "external",
        "summary": "Fedora Security Advisory FEDORA-2026-1A3AE49D07 vom 2026-10-22",
        "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-1a3ae49d07"
      }
    ],
    "source_lang": "en-US",
    "title": "OpenSSH: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2026-10-22T22:00:00.000+00:00",
      "generator": {
        "date": "2026-10-23T09:31:20.634+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.6.0"
        }
      },
      "id": "WID-SEC-W-2026-3785",
      "initial_release_date": "2026-10-06T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-10-06T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2026-10-14T22:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von Ubuntu aufgenommen"
        },
        {
          "date": "2026-10-19T22:00:00.000+00:00",
          "number": "3",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2026-10-21T22:00:00.000+00:00",
          "number": "4",
          "summary": "Neue Updates von Fedora aufgenommen"
        },
        {
          "date": "2026-10-22T22:00:00.000+00:00",
          "number": "5",
          "summary": "Neue Updates von Fedora aufgenommen"
        }
      ],
      "status": "final",
      "version": "5"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Fedora Linux",
            "product": {
              "name": "Fedora Linux",
              "product_id": "74178",
              "product_identification_helper": {
                "cpe": "cpe:/o:fedoraproject:fedora:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Fedora"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c10.6p1",
                "product": {
                  "name": "Open Source OpenSSH \u003c10.6p1",
                  "product_id": "T060717"
                }
              },
              {
                "category": "product_version",
                "name": "10.6p1",
                "product": {
                  "name": "Open Source OpenSSH 10.6p1",
                  "product_id": "T060717-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:openbsd:openssh:10.6p1"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c=10.6",
                "product": {
                  "name": "Open Source OpenSSH \u003c=10.6",
                  "product_id": "T060718"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c=10.6",
                "product": {
                  "name": "Open Source OpenSSH \u003c=10.6",
                  "product_id": "T060718-fixed"
                }
              }
            ],
            "category": "product_name",
            "name": "OpenSSH"
          }
        ],
        "category": "vendor",
        "name": "Open Source"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Red Hat Enterprise Linux",
            "product": {
              "name": "Red Hat Enterprise Linux",
              "product_id": "67646",
              "product_identification_helper": {
                "cpe": "cpe:/o:redhat:enterprise_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Ubuntu Linux",
            "product": {
              "name": "Ubuntu Linux",
              "product_id": "T055947",
              "product_identification_helper": {
                "cpe": "cpe:/o:canonical:ubuntu_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Ubuntu"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-106552",
      "product_status": {
        "known_affected": [
          "T060717",
          "67646",
          "T055947",
          "74178"
        ],
        "last_affected": [
          "T060718"
        ]
      },
      "release_date": "2026-10-06T22:00:00.000+00:00",
      "title": "CVE-2026-106552"
    },
    {
      "cve": "CVE-2026-106553",
      "product_status": {
        "known_affected": [
          "T060717",
          "67646",
          "T055947",
          "74178"
        ],
        "last_affected": [
          "T060718"
        ]
      },
      "release_date": "2026-10-06T22:00:00.000+00:00",
      "title": "CVE-2026-106553"
    },
    {
      "cve": "CVE-2026-106555",
      "product_status": {
        "known_affected": [
          "T060717",
          "67646",
          "T055947",
          "74178"
        ],
        "last_affected": [
          "T060718"
        ]
      },
      "release_date": "2026-10-06T22:00:00.000+00:00",
      "title": "CVE-2026-106555"
    },
    {
      "cve": "CVE-2026-106582",
      "product_status": {
        "known_affected": [
          "T060717",
          "67646",
          "T055947",
          "74178"
        ],
        "last_affected": [
          "T060718"
        ]
      },
      "release_date": "2026-10-06T22:00:00.000+00:00",
      "title": "CVE-2026-106582"
    },
    {
      "cve": "CVE-2026-106583",
      "product_status": {
        "known_affected": [
          "T060717",
          "67646",
          "T055947",
          "74178"
        ],
        "last_affected": [
          "T060718"
        ]
      },
      "release_date": "2026-10-06T22:00:00.000+00:00",
      "title": "CVE-2026-106583"
    },
    {
      "cve": "CVE-2026-106584",
      "product_status": {
        "known_affected": [
          "T060717",
          "67646",
          "T055947",
          "74178"
        ],
        "last_affected": [
          "T060718"
        ]
      },
      "release_date": "2026-10-06T22:00:00.000+00:00",
      "title": "CVE-2026-106584"
    },
    {
      "cve": "CVE-2026-106585",
      "product_status": {
        "known_affected": [
          "T060717",
          "67646",
          "T055947",
          "74178"
        ],
        "last_affected": [
          "T060718"
        ]
      },
      "release_date": "2026-10-06T22:00:00.000+00:00",
      "title": "CVE-2026-106585"
    },
    {
      "cve": "CVE-2026-106586",
      "product_status": {
        "known_affected": [
          "T060717",
          "67646",
          "T055947",
          "74178"
        ],
        "last_affected": [
          "T060718"
        ]
      },
      "release_date": "2026-10-06T22:00:00.000+00:00",
      "title": "CVE-2026-106586"
    },
    {
      "cve": "CVE-2026-106587",
      "product_status": {
        "known_affected": [
          "T060717",
          "67646",
          "T055947",
          "74178"
        ],
        "last_affected": [
          "T060718"
        ]
      },
      "release_date": "2026-10-06T22:00:00.000+00:00",
      "title": "CVE-2026-106587"
    },
    {
      "cve": "CVE-2026-106588",
      "product_status": {
        "known_affected": [
          "T060717",
          "67646",
          "T055947",
          "74178"
        ],
        "last_affected": [
          "T060718"
        ]
      },
      "release_date": "2026-10-06T22:00:00.000+00:00",
      "title": "CVE-2026-106588"
    },
    {
      "cve": "CVE-2026-106589",
      "product_status": {
        "known_affected": [
          "T060717",
          "67646",
          "T055947",
          "74178"
        ],
        "last_affected": [
          "T060718"
        ]
      },
      "release_date": "2026-10-06T22:00:00.000+00:00",
      "title": "CVE-2026-106589"
    }
  ]
}

CVE-2026-106589 (GCVE-0-2026-106589)

Vulnerability from cvelistv5 – Published: 2026-10-06 21:21 – Updated: 2026-10-07 15:46

Summary

In sshd in OpenSSH through 10.6, in certain environments such as QNX 6 and SCO OpenServer 5, sshd-session can unexpectedly have root privileges. This is related to the GatewayPorts and StreamLocalForwarding configuration options, and lack of support for file-descriptor passing and unprivileged allocation of PTY devices.

Severity

2.9 (Low)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-07 15:42 UTC

CWE

CWE-272 - Least Privilege Violation

Assigner

mitre mitre root Scorecard

References

1 reference

URL	Tags
https://www.openssh.org/releasenotes.html#10.6

Impacted products

1 product

Vendor	Product	Version
OpenBSD	OpenSSH	Affected: 0 , ≤ 10.6 (custom) cpe:2.3:a:openbsd:openssh::::::::

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-106589",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-07T15:42:26.762471Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-07T15:46:12.665Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "OpenSSH",
          "vendor": "OpenBSD",
          "versions": [
            {
              "lessThanOrEqual": "10.6",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "10.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In sshd in OpenSSH through 10.6, in certain environments such as QNX 6 and SCO OpenServer 5, sshd-session can unexpectedly have root privileges. This is related to the GatewayPorts and StreamLocalForwarding configuration options, and lack of support for file-descriptor passing and unprivileged allocation of PTY devices."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 2.9,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-272",
              "description": "CWE-272 Least Privilege Violation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-06T21:21:35.996Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://www.openssh.org/releasenotes.html#10.6"
        }
      ],
      "x_generator": {
        "engine": "CVE-Request-form 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2026-106589",
    "datePublished": "2026-10-06T21:21:35.996Z",
    "dateReserved": "2026-10-06T21:21:35.635Z",
    "dateUpdated": "2026-10-07T15:46:12.665Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Log in or create an account to share your comment.

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.