Security Risk in OpenSSH File Downloads by Root User

CVE-2026-35385

What is CVE-2026-35385?

A file downloaded using the legacy SCP protocol in OpenSSH versions prior to 10.3 can be mistakenly set with setuid or setgid permissions when executed as a root user. This behavior occurs if the -O option is used without the -p option to preserve file mode, leading to unintended elevation of privileges which can breach system security. Users need to be cautious about the implications of downloading files with such settings, as it could compromise system integrity.

References