Connection Multiplexing Vulnerability in OpenSSH by OpenSSH

CVE-2026-35388

What is CVE-2026-35388?

OpenSSH versions prior to 10.3 exhibit a critical flaw in their connection multiplexing functionality. Specifically, the library fails to confirm the proper setup of proxy-mode multiplexing sessions, which could enable an attacker to exploit the session without detection. This oversight may allow for unauthorized access to sensitive data or facilitate further exploitation of the infrastructure, making it crucial for users to upgrade to the latest version to mitigate potential risks.

References