Shell Metacharacter Exploit in OpenSSH Enables Command Execution

CVE-2026-35386

What is CVE-2026-35386?

Prior to version 10.3, OpenSSH is susceptible to a command execution vulnerability that can be exploited through shell metacharacters present in the username. This exploit arises when an untrusted username is used in a command line context and under specific non-default configurations in ssh_config that allow such manipulation. This poses a significant risk of unauthorized command execution, emphasizing the need for users to update their OpenSSH installations and apply standard security practices.

References