Improper Certificate Validation in Apache MINA SSHD by Apache

CVE-2026-56624

What is CVE-2026-56624?

The Apache MINA SSHD suffers from an improper certificate validation flaw during user authentication. This vulnerability allows for OpenSSH user certificates to include unsupported options such as force-command or verify-required, which are not properly validated by the server. Consequently, a user may authenticate with a certificate containing a force-command option and execute additional commands beyond what should be permissible. The specific commands available depend on the server's implementation. To mitigate this issue, it is recommended to upgrade to Apache MINA SSHD versions 2.19.0 or 3.0.0-M5, which enforce proper checks and reject certificates with these risky options.

References