Shell Injection Risk in OpenSSH Addressed by OpenSSH Corp
CVE-2026-110925

5.4MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8
Vendor
CVE Published:
15 October 2026

What is CVE-2026-110925?

A vulnerability in OpenSSH allows for potential shell injection due to improper handling of usernames within the ssh command line. Specifically, if a username contains special characters such as '$' or a non-trailing backslash, these can be improperly processed when configuration options like %u are expanded inside ProxyCommand or Match exec directives. This vulnerability can lead to unauthorized command execution, emphasizing the need for prompt patching to mitigate such risks.

References

https://access.redhat.com/security/cve/CVE-2026-110925
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2553034
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank SecBuddyF (KeenLab) for reporting this issue.
.